be231899f5
init: replace call to init_domtrans_script
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 17:09:06 +02:00
c75b2f3642
corecommands, files, filesystem, init, systemd: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-27 10:52:49 -04:00
d8da662d5e
Merge pull request #262 from bauen1/misc-fixes-1
2020-05-27 10:52:07 -04:00
382c5f7c09
domain, setrans: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-27 10:46:47 -04:00
5374e1ac16
Merge pull request #264 from bauen1/reenable-setrans
2020-05-27 10:46:08 -04:00
b184f71bed
init: fix init_manage_pid_symlinks to grant more than just create permissions
...
This was introduced in 4e842fe209
2020-05-27 14:23:18 +02:00
ab2c353048
systemd: allow systemd-user-runtime-dir to do its job
...
It requires access to /run/user/UID while running as root
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 14:03:05 +02:00
7eae84a8b4
lvm-activation-generator also needs to execute lvm
...
lvm will also try to read localization.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 14:03:05 +02:00
ee323d3b9a
filesystem: pathcon for matching tracefs mount
...
Prevent restorecon from trying to relabel /sys/fs/tracing .
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 11:51:36 +02:00
c9354399f9
corecommands: proper label for unattended-upgrades helpers
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 11:51:36 +02:00
ef0238d2d5
init: watch /etc/localtime even if it's a symlink
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 11:51:36 +02:00
70e0d26988
files: add files_watch_etc_symlinks interface
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-27 11:51:36 +02:00
9e2e343989
setrans: allow label translation for all domains.
...
This partially reverts commit 65da822c1b
2020-05-22 20:53:47 +02:00
8784dd0c66
init: allow systemd to activate journald-audit.socket
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-22 20:51:46 +02:00
5fb8157616
init: make initrc_t a init_domain to simplify the policy
...
This also allows init_t initrc_t:process2 nnp_transition which can be
required if the service isn't targeted.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-22 20:51:39 +02:00
14acb02b90
Merge pull request #259 from cgzones/apache
...
apache: use correct content types in apache_manage_all_user_content()
2020-05-22 14:50:11 -04:00
51d76f956f
init: allow systemd to setup mount namespaces
...
This is required to boot without the unconfined module.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-22 20:48:13 +02:00
72f7f7bfb1
Merge pull request #263 from cgzones/makefile_suffixes
...
Makefile: remove obsolete .SUFFIXES
2020-05-22 14:22:56 -04:00
f60bdf2d1b
Merge pull request #260 from cgzones/can_exec
...
can_exec(): move from misc_macros to misc_patterns
2020-05-22 14:21:20 -04:00
7366235e1e
Makefile: remove obsolete .SUFFIXES
...
With the removal of fc_sort there are no more .c files in the repository.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-21 11:42:45 +02:00
40a59af329
can_exec(): move from misc_macros to misc_patterns
...
The file misc_macros.spt is due heavy usage of the m4 language
hard to parse for third party tools.
Move the macro can_exec() to misc_patterns.spt, which contains
only interface like define blocks.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-15 15:59:13 +02:00
160e2016bb
apache: use correct content types in apache_manage_all_user_content()
...
The content types are named httpd_user_rw_content_t and
httpd_user_ra_content_t not httpd_user_content_rw_t and
httpd_user_content_ra_t in apache_content_template()
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-15 00:01:02 +02:00
5b171c223a
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-14 10:32:30 -04:00
28bf3cb4fb
Merge pull request #258 from bauen1/misc-fixes-1
2020-05-14 10:27:04 -04:00
2ab326ab2d
Merge pull request #253 from cgzones/selint
2020-05-14 10:27:00 -04:00
d9d94a93fd
Merge pull request #257 from pebenito/drop-py2-compat
...
genhomedircon: Drop Python 2 compatibility code.
2020-05-14 10:22:55 -04:00
09c028ead9
dnsmasq: watch for new dns resolvers
...
dnsmasq will watch /etc/resolv.conf for any changes to add new dns
servers immediately.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:51 +02:00
096b8f59f2
semanage: create directories for new policies
...
semodule will try to create a directory under /etc/selinux if the policy
it is modifying doesn't exist (e.g. it is being build for the first time).
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:31 +02:00
4f9772e309
systemd-fstab-generator needs to know about all mountpoints
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:30 +02:00
da561748d0
corecommands: fix atrild label
...
atrild is a daemon shipped by atril, see shell/Makefile.am of
https://github.com/mate-desktop/atril
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:30 +02:00
955c5c5253
lvm: create /etc/lvm/archive if it doesn't exist
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:27 +02:00
67dfa3651f
init: read default context during boot
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:26 +02:00
2b11987003
quota: allow quota to modify /aquota even if immutable
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:26 +02:00
0ff1f78619
systemd: allow regular users to run systemd-analyze
...
Same deal as with systemd-run this is potentially useful for non
privileged users and especially useful for admins.
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-14 09:31:17 +02:00
a229fb0e39
genhomedircon: Drop Python 2 compatibility code.
...
Python 2 is end-of-life.
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
2020-05-13 16:12:53 -04:00
57d570f01c
chromium/libraries: move lib_t filecontext to defining module
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-12 20:09:44 +02:00
2884cfe4bc
files/miscfiles: move usr_t filecontext to defining module
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-12 20:09:44 +02:00
75b3bcaf3e
files/logging: move var_run_t filecontext to defining module
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-12 20:09:44 +02:00
e7dad518eb
application: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-12 11:24:40 -04:00
5387a29b40
Merge pull request #255 from bauen1/fix-sudo-ssh
2020-05-12 11:24:10 -04:00
dd8ed0ba14
application: applications can be executed from ssh without pty
...
For example ansible uses `ssh localhost sudo id` to become root.
This doesn't appear to be necessary in redhat due to https://src.fedoraproject.org/rpms/openssh/blob/master/f/openssh-6.6p1-privsep-selinux.patch
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-05-12 16:52:59 +02:00
68a076bf43
dirmngr: Module version bump
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-05-12 10:50:57 -04:00
5e5b57b1eb
Merge pull request #256 from bauen1/fix-dirmngr
2020-05-12 10:49:43 -04:00
0ac9f4cb22
tpm2: small fixes
...
* Drop permissions implied by domtrans_pattern
* Use fifo_file permission macro for fifo_file class
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
d769c71848
init/systemd: move systemd_manage_all_units to init_manage_all_units
...
The attribute systemdunit is defined in the file init.te, so interfaces
granting access on it should be defined in init.if
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
e683d67f46
portage: drop bizarre conditional TODO blocks
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
8f308eb846
unconfined: clarify unconfined_t stub usage in unconfined_domain_noaudit()
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
f6a7365cc0
consolesetup: drop unused requires
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
20323a2ab5
example: use module name matching file name
...
Using a different name in a non-base module will be rejected by checkmodule
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
31153edcb4
chromium: drop dead conditional block
...
The condition `use_alsa` is nowhere defined, and the contained interface
`alsa_domain` does not exist.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-05-11 21:42:50 +02:00
bauen1
Chris PeBenito
Christian Göttsche
Chris PeBenito