1 files changed, 28 insertions, 0 deletions

diff --git a/recipes-security/refpolicy/refpolicy/0016-fc-corecommands-apply-policy-to-nologin-alternatives.patch b/recipes-security/refpolicy/refpolicy/0016-fc-corecommands-apply-policy-to-nologin-alternatives.patch
new file mode 100644
index 0000000..8047863
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0016-fc-corecommands-apply-policy-to-nologin-alternatives.patch
@@ -0,0 +1,28 @@
+From 788d2c125f18dce9e0871fb260b4a0c394b9db53 Mon Sep 17 00:00:00 2001
+From: Yi Zhao <yi.zhao@windriver.com>
+Date: Fri, 15 Nov 2019 10:21:51 +0800
+Subject: [PATCH] fc/corecommands: apply policy to nologin alternatives
+
+Upstream-Status: Inappropriate [embedded specific]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ policy/modules/kernel/corecommands.fc | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
+index 1edc035f3..258d97c3c 100644
+--- a/policy/modules/kernel/corecommands.fc
++++ b/policy/modules/kernel/corecommands.fc
+@@ -308,6 +308,8 @@ ifdef(`distro_debian',`
+ /usr/sbin/insmod_ksymoops_clean        --      gen_context(system_u:object_r:bin_t,s0)
+ /usr/sbin/mkfs\.cramfs         --      gen_context(system_u:object_r:bin_t,s0)
+ /usr/sbin/nologin              --      gen_context(system_u:object_r:shell_exec_t,s0)
++/usr/sbin/nologin\.shadow              --      gen_context(system_u:object_r:shell_exec_t,s0)
++/usr/sbin/nologin\.util-linux          --      gen_context(system_u:object_r:shell_exec_t,s0)
+ /usr/sbin/scponlyc             --      gen_context(system_u:object_r:shell_exec_t,s0)
+ /usr/sbin/sesh                 --      gen_context(system_u:object_r:shell_exec_t,s0)
+ /usr/sbin/smrsh                        --      gen_context(system_u:object_r:shell_exec_t,s0)
+-- 
+2.25.1
+