1 files changed, 7 insertions, 119 deletions

diff --git a/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch b/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
index 89bc68e..9939b59 100644
--- a/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
+++ b/recipes-security/refpolicy/refpolicy/0001-refpolicy-targeted-make-unconfined_u-the-default-sel.patch
@@ -1,4 +1,4 @@
-From 7ff6cf3766a672c4f2b7bd0dc5efa296bd6aba51 Mon Sep 17 00:00:00 2001
+From bf7b74e7c38b546e162eb5a3bd4774e3d84d593d Mon Sep 17 00:00:00 2001
 From: Yi Zhao <yi.zhao@windriver.com>
 Date: Mon, 20 Apr 2020 11:50:03 +0800
 Subject: [PATCH] refpolicy-targeted: make unconfined_u the default selinux
@@ -8,9 +8,6 @@ For targeted policy type, we define unconfined_u as the default selinux
 user for root and normal users, so users could login in and run most
 commands and services on unconfined domains.
 
-Also add rules for users to run init scripts directly, instead of via
-run_init.
-
 Upstream-Status: Inappropriate [configuration]
 
 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
@@ -18,13 +15,11 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
 Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 ---
- config/appconfig-mcs/failsafe_context |  2 +-
- config/appconfig-mcs/seusers          |  4 +--
- policy/modules/roles/sysadm.te        |  1 +
- policy/modules/system/init.if         | 42 +++++++++++++++++++++++----
- policy/modules/system/unconfined.te   |  7 +++++
- policy/users                          |  6 ++--
- 6 files changed, 50 insertions(+), 12 deletions(-)
+ config/appconfig-mcs/failsafe_context | 2 +-
+ config/appconfig-mcs/seusers          | 4 ++--
+ policy/modules/system/unconfined.te   | 5 +++++
+ policy/users                          | 6 +++---
+ 4 files changed, 11 insertions(+), 6 deletions(-)
 
 diff --git a/config/appconfig-mcs/failsafe_context b/config/appconfig-mcs/failsafe_context
 index 999abd9a3..a50bde775 100644
@@ -42,106 +37,8 @@ index ce614b41b..c0903d98b 100644
 -__default__:user_u:s0
 +root:unconfined_u:s0-mcs_systemhigh
 +__default__:unconfined_u:s0
-diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
-index ce7d77d31..1aff2c31a 100644
---- a/policy/modules/roles/sysadm.te
-+++ b/policy/modules/roles/sysadm.te
-@@ -53,6 +53,7 @@ ubac_fd_exempt(sysadm_t)
- 
- init_exec(sysadm_t)
- init_admin(sysadm_t)
-+init_script_role_transition(sysadm_r)
- 
- # Add/remove user home directories
- userdom_manage_user_home_dirs(sysadm_t)
-diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
-index 98e94283f..eb6d5b32d 100644
---- a/policy/modules/system/init.if
-+++ b/policy/modules/system/init.if
-@@ -1821,11 +1821,12 @@ interface(`init_script_file_entry_type',`
- #
- interface(`init_spec_domtrans_script',`
-        gen_require(`
--               type initrc_t, initrc_exec_t;
-+               type initrc_t;
-+               attribute init_script_file_type;
-        ')
- 
-        files_list_etc($1)
--       spec_domtrans_pattern($1, initrc_exec_t, initrc_t)
-+       spec_domtrans_pattern($1, init_script_file_type, initrc_t)
- 
-        ifdef(`distro_gentoo',`
-                gen_require(`
-@@ -1836,11 +1837,11 @@ interface(`init_spec_domtrans_script',`
-        ')
- 
-        ifdef(`enable_mcs',`
--               range_transition $1 initrc_exec_t:process s0;
-+               range_transition $1 init_script_file_type:process s0;
-        ')
- 
-        ifdef(`enable_mls',`
--               range_transition $1 initrc_exec_t:process s0 - mls_systemhigh;
-+               range_transition $1 init_script_file_type:process s0 - mls_systemhigh;
-        ')
- ')
- 
-@@ -1857,17 +1858,18 @@ interface(`init_spec_domtrans_script',`
- interface(`init_domtrans_script',`
-        gen_require(`
-                type initrc_t, initrc_exec_t;
-+               attribute init_script_file_type;
-        ')
- 
-        files_list_etc($1)
-        domtrans_pattern($1, initrc_exec_t, initrc_t)
- 
-        ifdef(`enable_mcs',`
--               range_transition $1 initrc_exec_t:process s0;
-+               range_transition $1 init_script_file_type:process s0;
-        ')
- 
-        ifdef(`enable_mls',`
--               range_transition $1 initrc_exec_t:process s0 - mls_systemhigh;
-+               range_transition $1 init_script_file_type:process s0 - mls_systemhigh;
-        ')
- ')
- 
-@@ -3532,3 +3534,31 @@ interface(`init_getrlimit',`
- 
-        allow $1 init_t:process getrlimit;
- ')
-+
-+########################################
-+## <summary>
-+##     Transition to system_r when execute an init script
-+## </summary>
-+## <desc>
-+##     <p>
-+##     Execute a init script in a specified role
-+##     </p>
-+##     <p>
-+##     No interprocess communication (signals, pipes,
-+##     etc.) is provided by this interface since
-+##     the domains are not owned by this module.
-+##     </p>
-+## </desc>
-+## <param name="source_role">
-+##     <summary>
-+##     Role to transition from.
-+##     </summary>
-+## </param>
-+#
-+interface(`init_script_role_transition',`
-+       gen_require(`
-+               attribute init_script_file_type;
-+       ')
-+
-+       role_transition $1 init_script_file_type system_r;
-+')
 diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
-index 385c88695..87adb7e9d 100644
+index 4972094cb..b6d769412 100644
 --- a/policy/modules/system/unconfined.te
 +++ b/policy/modules/system/unconfined.te
 @@ -20,6 +20,11 @@ type unconfined_execmem_t alias ada_t;
@@ -156,15 +53,6 @@ index 385c88695..87adb7e9d 100644
  
  ########################################
  #
-@@ -50,6 +55,8 @@ userdom_user_home_dir_filetrans_user_home_content(unconfined_t, { dir file lnk_f
- ifdef(`direct_sysadm_daemon',`
-         optional_policy(`
-                 init_run_daemon(unconfined_t, unconfined_r)
-+                init_domtrans_script(unconfined_t)
-+                init_script_role_transition(unconfined_r)
-         ')
- ',`
-         ifdef(`distro_gentoo',`
 diff --git a/policy/users b/policy/users
 index ca203758c..e737cd9cc 100644
 --- a/policy/users