From 776da889b550ac9e5be414a8cc10fd86b1923264 Mon Sep 17 00:00:00 2001 From: Joe MacDonald Date: Mon, 8 Apr 2019 13:50:40 -0400 Subject: refpolicy: update to 2.20190201 and git HEAD policies Additionally, the README has fallen out of date, update it to reflect the current reality of layer dependencies. Signed-off-by: Joe MacDonald --- ...cy-module-rpc-allow-sysadm-to-run-rpcinfo.patch | 31 ++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 recipes-security/refpolicy/refpolicy-git/0027-policy-module-rpc-allow-sysadm-to-run-rpcinfo.patch (limited to 'recipes-security/refpolicy/refpolicy-git/0027-policy-module-rpc-allow-sysadm-to-run-rpcinfo.patch') diff --git a/recipes-security/refpolicy/refpolicy-git/0027-policy-module-rpc-allow-sysadm-to-run-rpcinfo.patch b/recipes-security/refpolicy/refpolicy-git/0027-policy-module-rpc-allow-sysadm-to-run-rpcinfo.patch new file mode 100644 index 0000000..23226a0 --- /dev/null +++ b/recipes-security/refpolicy/refpolicy-git/0027-policy-module-rpc-allow-sysadm-to-run-rpcinfo.patch @@ -0,0 +1,31 @@ +From 447036f5ead83977933b375f5587595b85307a7d Mon Sep 17 00:00:00 2001 +From: Roy Li +Date: Sat, 15 Feb 2014 09:45:00 +0800 +Subject: [PATCH 27/34] policy/module/rpc: allow sysadm to run rpcinfo + +Upstream-Status: Pending + +type=AVC msg=audit(1392427946.976:264): avc: denied { connectto } for pid=2111 comm="rpcinfo" path="/run/rpcbind.sock" scontext=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 tcontext=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 tclass=unix_stream_socket +type=SYSCALL msg=audit(1392427946.976:264): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=7fff3aa20000 a2=17 a3=22 items=0 ppid=2108 pid=2111 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=pts0 comm="rpcinfo" exe="/usr/sbin/rpcinfo" subj=system_u:system_r:rpcbind_t:s0-s15:c0.c1023 key=(null) + +Signed-off-by: Roy Li +Signed-off-by: Joe MacDonald +--- + policy/modules/roles/sysadm.te | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te +index 2ae952bf..d781378f 100644 +--- a/policy/modules/roles/sysadm.te ++++ b/policy/modules/roles/sysadm.te +@@ -945,6 +945,7 @@ optional_policy(` + ') + + optional_policy(` ++ rpcbind_stream_connect(sysadm_t) + rpcbind_admin(sysadm_t, sysadm_r) + ') + +-- +2.19.1 + -- cgit v1.2.3-54-g00ecf