summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorXin Ouyang <Xin.Ouyang@windriver.com>2013-03-19 11:04:06 +0800
committerXin Ouyang <Xin.Ouyang@windriver.com>2013-03-19 11:07:53 +0800
commitf1133427689eb458eb1d203d42a2a0aa80188b49 (patch)
tree612dd66e8158bd259ae8a3f8f24070a3c27db7b1
parent587fdba43a7747992995029a88d3051ef0efe7f6 (diff)
downloadmeta-selinux-f1133427689eb458eb1d203d42a2a0aa80188b49.tar.gz
refpolicy*: fix file contexts for many oe-core recipes
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
Diffstat
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-cgroup.patch26
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-clock.patch22
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-corecommands.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-dmesg.patch20
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fstools.patch65
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-iptables.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-mta.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-netutils.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-networkmanager.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-nscd.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-screen.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-ssh.patch24
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-su.patch23
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-sysnetwork.patch41
-rw-r--r--recipes-security/refpolicy/refpolicy_2.20120725.inc14
15 files changed, 403 insertions, 0 deletions
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-cgroup.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-cgroup.patch
new file mode 100644
index 0000000..e5cfaa1
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-cgroup.patch
@@ -0,0 +1,26 @@
1Subject: [PATCH] refpolicy: fix real path for cgroup
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/cgroup.fc | 3 +++
8 1 file changed, 3 insertions(+)
9
10diff --git a/policy/modules/contrib/cgroup.fc b/policy/modules/contrib/cgroup.fc
11index b6bb46c..e214727 100644
12--- a/policy/modules/contrib/cgroup.fc
13+++ b/policy/modules/contrib/cgroup.fc
14@@ -10,6 +10,9 @@
15 /sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfig_exec_t,s0)
16 /sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0)
17 /sbin/cgclear -- gen_context(system_u:object_r:cgclear_exec_t,s0)
18+/usr/sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfig_exec_t,s0)
19+/usr/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0)
20+/usr/sbin/cgclear -- gen_context(system_u:object_r:cgclear_exec_t,s0)
21
22 /var/log/cgrulesengd\.log -- gen_context(system_u:object_r:cgred_log_t,s0)
23 /var/run/cgred.* gen_context(system_u:object_r:cgred_var_run_t,s0)
24--
251.7.11.7
26
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-clock.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-clock.patch
new file mode 100644
index 0000000..3ff8f55
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-clock.patch
@@ -0,0 +1,22 @@
1Subject: [PATCH] refpolicy: fix real path for clock
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/clock.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/system/clock.fc b/policy/modules/system/clock.fc
11index c5e05ca..a74c40c 100644
12--- a/policy/modules/system/clock.fc
13+++ b/policy/modules/system/clock.fc
14@@ -2,4 +2,5 @@
15 /etc/adjtime -- gen_context(system_u:object_r:adjtime_t,s0)
16
17 /sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)
18+/sbin/hwclock\.util-linux -- gen_context(system_u:object_r:hwclock_exec_t,s0)
19
20--
211.7.11.7
22
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-corecommands.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-corecommands.patch
new file mode 100644
index 0000000..24b67c3
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-corecommands.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for corecommands
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/kernel/corecommands.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
11index f051c4a..ab624f3 100644
12--- a/policy/modules/kernel/corecommands.fc
13+++ b/policy/modules/kernel/corecommands.fc
14@@ -153,6 +153,7 @@ ifdef(`distro_gentoo',`
15 /sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0)
16 /sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
17 /sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
18+/usr/sbin/nologin -- gen_context(system_u:object_r:shell_exec_t,s0)
19
20 #
21 # /opt
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-dmesg.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-dmesg.patch
new file mode 100644
index 0000000..db4c4d4
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-dmesg.patch
@@ -0,0 +1,20 @@
1Subject: [PATCH] refpolicy: fix real path for dmesg
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/dmesg.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/dmesg.fc b/policy/modules/admin/dmesg.fc
11index d6cc2d9..7f3e5b0 100644
12--- a/policy/modules/admin/dmesg.fc
13+++ b/policy/modules/admin/dmesg.fc
14@@ -1,2 +1,3 @@
15
16 /bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
17+/bin/dmesg\.util-linux -- gen_context(system_u:object_r:dmesg_exec_t,s0)
18--
191.7.11.7
20
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fstools.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fstools.patch
new file mode 100644
index 0000000..b74f8d3
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-fstools.patch
@@ -0,0 +1,65 @@
1Subject: [PATCH] refpolicy: fix real path for fstools
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/fstools.fc | 11 +++++++++++
8 1 file changed, 11 insertions(+)
9
10diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
11index a97a096..d996b29 100644
12--- a/policy/modules/system/fstools.fc
13+++ b/policy/modules/system/fstools.fc
14@@ -1,6 +1,8 @@
15 /sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
16 /sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
17+/sbin/blkid\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
18 /sbin/blockdev -- gen_context(system_u:object_r:fsadm_exec_t,s0)
19+/sbin/blockdev\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
20 /sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
21 /sbin/dosfsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
22 /sbin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0)
23@@ -9,9 +11,12 @@
24 /sbin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)
25 /sbin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0)
26 /sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
27+/sbin/fdisk\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
28 /sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
29+/usr/sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
30 /sbin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
31 /sbin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
32+/sbin/hdparm\.hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
33 /sbin/install-mbr -- gen_context(system_u:object_r:fsadm_exec_t,s0)
34 /sbin/jfs_.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
35 /sbin/losetup.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
36@@ -24,20 +29,26 @@
37 /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
38 /sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
39 /sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0)
40+/sbin/mkswap\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
41 /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
42+/usr/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
43 /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
44+/usr/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
45 /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
46+/usr/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
47 /sbin/raidautorun -- gen_context(system_u:object_r:fsadm_exec_t,s0)
48 /sbin/raidstart -- gen_context(system_u:object_r:fsadm_exec_t,s0)
49 /sbin/reiserfs(ck|tune) -- gen_context(system_u:object_r:fsadm_exec_t,s0)
50 /sbin/resize.*fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
51 /sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)
52 /sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
53+/usr/sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
54 /sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
55 /sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
56
57 /usr/bin/partition_uuid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
58 /usr/bin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
59+/usr/sbin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
60 /usr/bin/scsi_unique_id -- gen_context(system_u:object_r:fsadm_exec_t,s0)
61 /usr/bin/syslinux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
62
63--
641.7.11.7
65
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-iptables.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-iptables.patch
new file mode 100644
index 0000000..89b1547
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-iptables.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for iptables
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/iptables.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
11index 14cffd2..84ac92b 100644
12--- a/policy/modules/system/iptables.fc
13+++ b/policy/modules/system/iptables.fc
14@@ -13,6 +13,7 @@
15 /sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
16 /sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
17 /sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
18+/usr/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
19
20 /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
21 /usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-mta.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-mta.patch
new file mode 100644
index 0000000..3b4da9e
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-mta.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for mta
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/mta.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/contrib/mta.fc b/policy/modules/contrib/mta.fc
11index afa18c8..aeea97a 100644
12--- a/policy/modules/contrib/mta.fc
13+++ b/policy/modules/contrib/mta.fc
14@@ -18,6 +18,7 @@ ifdef(`distro_redhat',`
15
16 /usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0)
17 /usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0)
18+/usr/bin/msmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
19 /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0)
20 /usr/sbin/ssmtp -- gen_context(system_u:object_r:sendmail_exec_t,s0)
21
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-netutils.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-netutils.patch
new file mode 100644
index 0000000..b45d03e
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-netutils.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for netutils
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/netutils.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/netutils.fc b/policy/modules/admin/netutils.fc
11index 407078f..f2ed3dc 100644
12--- a/policy/modules/admin/netutils.fc
13+++ b/policy/modules/admin/netutils.fc
14@@ -3,6 +3,7 @@
15 /bin/traceroute.* -- gen_context(system_u:object_r:traceroute_exec_t,s0)
16
17 /sbin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
18+/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)
19
20 /usr/bin/lft -- gen_context(system_u:object_r:traceroute_exec_t,s0)
21 /usr/bin/nmap -- gen_context(system_u:object_r:traceroute_exec_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-networkmanager.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-networkmanager.patch
new file mode 100644
index 0000000..1da6d22
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-networkmanager.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for networkmanager
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/networkmanager.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/contrib/networkmanager.fc b/policy/modules/contrib/networkmanager.fc
11index 386543b..e0739b5 100644
12--- a/policy/modules/contrib/networkmanager.fc
13+++ b/policy/modules/contrib/networkmanager.fc
14@@ -5,6 +5,7 @@
15 /usr/libexec/nm-dispatcher.action -- gen_context(system_u:object_r:NetworkManager_initrc_exec_t,s0)
16
17 /sbin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0)
18+/usr/sbin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0)
19 /sbin/wpa_supplicant -- gen_context(system_u:object_r:NetworkManager_exec_t,s0)
20
21 /usr/s?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-nscd.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-nscd.patch
new file mode 100644
index 0000000..c347919
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-nscd.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for nscd
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/nscd.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/contrib/nscd.fc b/policy/modules/contrib/nscd.fc
11index 623b731..9e4b3d0 100644
12--- a/policy/modules/contrib/nscd.fc
13+++ b/policy/modules/contrib/nscd.fc
14@@ -1,6 +1,7 @@
15 /etc/rc\.d/init\.d/nscd -- gen_context(system_u:object_r:nscd_initrc_exec_t,s0)
16
17 /usr/sbin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
18+/usr/bin/nscd -- gen_context(system_u:object_r:nscd_exec_t,s0)
19
20 /var/db/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
21 /var/cache/nscd(/.*)? gen_context(system_u:object_r:nscd_var_run_t,s0)
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-screen.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-screen.patch
new file mode 100644
index 0000000..ff4a2fd
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-screen.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for screen
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/contrib/screen.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/contrib/screen.fc b/policy/modules/contrib/screen.fc
11index c8254dd..4a321d1 100644
12--- a/policy/modules/contrib/screen.fc
13+++ b/policy/modules/contrib/screen.fc
14@@ -8,6 +8,7 @@ HOME_DIR/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0)
15 # /usr
16 #
17 /usr/bin/screen -- gen_context(system_u:object_r:screen_exec_t,s0)
18+/usr/bin/screen-.* -- gen_context(system_u:object_r:screen_exec_t,s0)
19
20 #
21 # /var
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-ssh.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-ssh.patch
new file mode 100644
index 0000000..9aeb3a2
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-ssh.patch
@@ -0,0 +1,24 @@
1Subject: [PATCH] refpolicy: fix real path for ssh
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/services/ssh.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
11index 078bcd7..9717428 100644
12--- a/policy/modules/services/ssh.fc
13+++ b/policy/modules/services/ssh.fc
14@@ -6,6 +6,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
15 /etc/ssh/ssh_host_rsa_key -- gen_context(system_u:object_r:sshd_key_t,s0)
16
17 /usr/bin/ssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
18+/usr/bin/ssh\.openssh -- gen_context(system_u:object_r:ssh_exec_t,s0)
19 /usr/bin/ssh-agent -- gen_context(system_u:object_r:ssh_agent_exec_t,s0)
20 /usr/bin/ssh-keygen -- gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
21
22--
231.7.11.7
24
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-su.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-su.patch
new file mode 100644
index 0000000..358e4ef
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-su.patch
@@ -0,0 +1,23 @@
1Subject: [PATCH] refpolicy: fix real path for su
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/admin/su.fc | 1 +
8 1 file changed, 1 insertion(+)
9
10diff --git a/policy/modules/admin/su.fc b/policy/modules/admin/su.fc
11index 688abc2..a563687 100644
12--- a/policy/modules/admin/su.fc
13+++ b/policy/modules/admin/su.fc
14@@ -1,5 +1,6 @@
15
16 /bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
17+/usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)
18
19 /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)
20 /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)
21--
221.7.11.7
23
diff --git a/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-sysnetwork.patch b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-sysnetwork.patch
new file mode 100644
index 0000000..e0af6a1
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20120725/poky-fc-sysnetwork.patch
@@ -0,0 +1,41 @@
1Subject: [PATCH] refpolicy: fix real path for sysnetwork
2
3Upstream-Status: Inappropriate [configuration]
4
5Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
6---
7 policy/modules/system/sysnetwork.fc | 4 ++++
8 1 file changed, 4 insertions(+)
9
10diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
11index dec8632..2e602e4 100644
12--- a/policy/modules/system/sysnetwork.fc
13+++ b/policy/modules/system/sysnetwork.fc
14@@ -3,6 +3,7 @@
15 # /bin
16 #
17 /bin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
18+/sbin/ip\.iproute2 -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
19
20 #
21 # /dev
22@@ -43,13 +44,16 @@ ifdef(`distro_redhat',`
23 /sbin/dhcdbd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
24 /sbin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
25 /sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
26+/usr/sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
27 /sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
28+/sbin/ifconfig\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
29 /sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
30 /sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
31 /sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
32 /sbin/ipx_internal_net -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
33 /sbin/iwconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
34 /sbin/mii-tool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
35+/sbin/mii-tool\.net-tools -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
36 /sbin/pump -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
37 /sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
38
39--
401.7.11.7
41
diff --git a/recipes-security/refpolicy/refpolicy_2.20120725.inc b/recipes-security/refpolicy/refpolicy_2.20120725.inc
index 89c0054..7c01e89 100644
--- a/recipes-security/refpolicy/refpolicy_2.20120725.inc
+++ b/recipes-security/refpolicy/refpolicy_2.20120725.inc
@@ -16,6 +16,20 @@ SRC_URI += "file://poky-fc-subs_dist.patch \
16 file://poky-fc-fix-real-path_shadow.patch \ 16 file://poky-fc-fix-real-path_shadow.patch \
17 file://poky-fc-fix-bind.patch \ 17 file://poky-fc-fix-bind.patch \
18 file://poky-fc-fix-portmap.patch \ 18 file://poky-fc-fix-portmap.patch \
19 file://poky-fc-cgroup.patch \
20 file://poky-fc-clock.patch \
21 file://poky-fc-corecommands.patch \
22 file://poky-fc-dmesg.patch \
23 file://poky-fc-fstools.patch \
24 file://poky-fc-iptables.patch \
25 file://poky-fc-mta.patch \
26 file://poky-fc-netutils.patch \
27 file://poky-fc-networkmanager.patch \
28 file://poky-fc-nscd.patch \
29 file://poky-fc-screen.patch \
30 file://poky-fc-ssh.patch \
31 file://poky-fc-su.patch \
32 file://poky-fc-sysnetwork.patch \
19 " 33 "
20 34
21# Specific policy for Poky 35# Specific policy for Poky
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-11-04 00:25:35 +0000