35a417d0ef
ntp: allow systemd-timesyn to setfscreate
...
Fixes:
avc: denied { setfscreate } for pid=68 comm="systemd-timesyn"
scontext=system_u:system_r:ntpd_t tcontext=system_u:system_r:ntpd_t
tclass=process permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-10-09 08:58:31 +02:00
32e5008867
ntp: allow systemd-timesyn to watch dbus objects
...
Fixes:
avc: denied { watch } for pid=68 comm="systemd-timesyn"
path="/run/dbus" dev="tmpfs" ino=2707 scontext=system_u:system_r:ntpd_t
tcontext=system_u:object_r:system_dbusd_runtime_t tclass=dir
permissive=1
avc: denied { watch } for pid=68 comm="systemd-timesyn"
path="/run/dbus/system_bus_socket" dev="tmpfs" ino=2716
scontext=system_u:system_r:ntpd_t
tcontext=system_u:object_r:system_dbusd_runtime_t tclass=sock_file
permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-10-09 08:58:31 +02:00
e9228b49bb
systemd: allow systemd-network to list the runtime directory
...
Fixes:
avc: denied { read } for pid=58 comm="systemd-network" name="/"
dev="tmpfs" ino=652 scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:var_run_t tclass=dir permissive=1
avc: denied { read } for pid=58 comm="systemd-network" name="/"
dev="tmpfs" ino=652 scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:var_run_t tclass=dir permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-10-09 08:58:31 +02:00
49a0771dd3
systemd: allow systemd-getty-generator to read and write unallocated ttys
...
Fixes:
avc: denied { read write } for pid=40 comm="systemd-getty-g"
name="ttyS0" dev="devtmpfs" ino=612
scontext=system_u:system_r:systemd_generator_t
tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1
avc: denied { open } for pid=40 comm="systemd-getty-g"
path="/dev/ttyS0" dev="devtmpfs" ino=612
scontext=system_u:system_r:systemd_generator_t
tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1
avc: denied { ioctl } for pid=40 comm="systemd-getty-g"
path="/dev/ttyS0" dev="devtmpfs" ino=612 ioctlcmd=0x5401
scontext=system_u:system_r:systemd_generator_t
tcontext=system_u:object_r:tty_device_t tclass=chr_file permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-10-09 08:58:31 +02:00
f5c8a117d9
Add selinux-policy for systemd-pstore service
...
systemd-pstore is a service to archive contents of pstore.
Signed-off-by: Deepak Rawat <drawat.floss@gmail.com>
2020-10-09 03:20:09 +00:00
bc7a84d643
snmp: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-10-05 09:55:13 -04:00
3a1bae3b6d
Merge pull request #310 from dsugar100/snmp_read_hwdata
2020-10-05 09:54:20 -04:00
9da3f3a131
Allow snmpd to read hwdata
...
Oct 1 16:11:49 localhost audispd: node=virtual type=AVC msg=audit(1601568708.950:2198): avc: denied { getattr } for pid=4114 comm="snmpd" path="/usr/share/hwdata/pci.ids" dev="dm-0" ino=76435 scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=file permissive=1
Oct 1 16:11:49 localhost audispd: node=virtual type=AVC msg=audit(1601568708.950:2197): avc: denied { read } for pid=4114 comm="snmpd" name="pci.ids" dev="dm-0" ino=76435 scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=file permissive=1
Oct 1 16:11:49 localhost audispd: node=virtual type=AVC msg=audit(1601568708.950:2197): avc: denied { open } for pid=4114 comm="snmpd" path="/usr/share/hwdata/pci.ids" dev="dm-0" ino=76435 scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=file permissive=1
Signed-off-by: Dave Sugar <dsugar@tresys.com>
2020-10-01 22:11:28 -04:00
39e2af539d
corecommands, dbus, locallogin, logging, sysnetwork, systemd, udev: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-09-22 08:27:05 -04:00
941620c89c
Merge pull request #309 from yizhao1/dhcpcd
2020-09-22 08:23:49 -04:00
4ac187dba2
Merge pull request #307 from atenart/buildroot-fixes
2020-09-22 08:23:45 -04:00
86476f30cf
corecommands: add entry for Busybox shell
...
Fixes:
vc: denied { execute } for pid=87 comm="login" name="sh" dev="vda"
ino=408 scontext=system_u:system_r:local_login_t
tcontext=system_u:object_r:bin_t tclass=file permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-09-21 16:25:09 +02:00
fdda7befa5
systemd: allow systemd-resolve to read in tmpfs
...
Fixes:
avc: denied { read } for pid=76 comm="systemd-resolve" name="/"
dev="tmpfs" ino=651 scontext=system_u:system_r:systemd_resolved_t
tcontext=system_u:object_r:var_run_t tclass=dir permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-09-21 16:25:09 +02:00
34547434b8
systemd: allow systemd-network to get attributes of fs
...
Fixes:
avc: denied { getattr } for pid=57 comm="systemd-network" name="/"
dev="vda" ino=2 scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:fs_t tclass=filesystem permissive=0
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-09-21 16:25:09 +02:00
1ee738f708
systemd: allow systemd-hwdb to search init runtime directories
...
Fixes:
avc: denied { search } for pid=54 comm="systemd-hwdb" name="systemd"
dev="tmpfs" ino=664 scontext=system_u:system_r:systemd_hw_t
tcontext=system_u:object_r:init_runtime_t tclass=dir permissive=1
avc: denied { search } for pid=54 comm="systemd-hwdb" name="systemd"
dev="tmpfs" ino=664 scontext=system_u:system_r:systemd_hw_t
tcontext=system_u:object_r:init_runtime_t tclass=dir permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-09-21 16:15:37 +02:00
f71d288e54
systemd: add extra systemd_generator_t rules
...
Fixes:
avc: denied { setfscreate } for pid=41 comm="systemd-getty-g"
scontext=system_u:system_r:systemd_generator_t
tcontext=system_u:system_r:systemd_generator_t tclass=process
permissive=1
avc: denied { dac_override } for pid=40 comm="systemd-fstab-g"
capability=1 scontext=system_u:system_r:systemd_generator_t
tcontext=system_u:system_r:systemd_generator_t tclass=capability
permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-09-21 16:15:37 +02:00
f99b6907f4
dbus: allow clients to list runtime dirs and named sockets
...
Fixes:
avc: denied { read } for pid=77 comm="systemd-resolve" name="dbus"
dev="tmpfs" ino=2748 scontext=system_u:system_r:systemd_resolved_t
tcontext=system_u:object_r:system_dbusd_runtime_t tclass=dir
permissive=1
avc: denied { read } for pid=77 comm="systemd-resolve"
name="system_bus_socket" dev="tmpfs" ino=2765
scontext=system_u:system_r:systemd_resolved_t
tcontext=system_u:object_r:system_dbusd_runtime_t tclass=sock_file
permissive=1
avc: denied { read } for pid=59 comm="systemd-network" name="dbus"
dev="tmpfs" ino=2777 scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:system_dbusd_runtime_t tclass=dir
permissive=1
avc: denied { read } for pid=59 comm="systemd-network"
name="system_bus_socket" dev="tmpfs" ino=2791
scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:system_dbusd_runtime_t tclass=sock_file
permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-09-21 16:15:37 +02:00
66c2ff9060
dbus: add two interfaces to allow reading from directories and named sockets
...
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-09-21 16:15:37 +02:00
25251b1f3b
sysnet: allow dhcpcd to create socket file
...
The dhcpcd needs to create socket file under /run/dhcpcd directory.
Fixes:
AVC avc: denied { create } for pid=331 comm="dhcpcd" name="eth0.sock"
scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
tcontext=system_u:object_r:dhcpc_runtime_t:s0 tclass=sock_file
permissive=0
AVC avc: denied { setattr } for pid=331 comm="dhcpcd"
name="eth0.sock" dev="tmpfs" ino=19153
scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
tcontext=system_u:object_r:dhcpc_runtime_t:s0 tclass=sock_file
permissive=0
AVC avc: denied { sendto } for pid=331 comm="dhcpcd"
scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
tclass=unix_dgram_socket permissive=0
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2020-09-21 14:23:09 +08:00
23f1e4316b
sysnetwork: allow to read network configuration files
...
Fixes:
avc: denied { getattr } for pid=55 comm="systemd-udevd"
path="/etc/systemd/network" dev="vda" ino=128
scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t
tclass=dir permissive=1
avc: denied { getattr } for pid=55 comm="systemd-udevd"
path="/etc/systemd/network" dev="vda" ino=128
scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t
tclass=dir permissive=1
avc: denied { read } for pid=55 comm="systemd-udevd" name="network"
dev="vda" ino=128 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1
avc: denied { read } for pid=55 comm="systemd-udevd" name="network"
dev="vda" ino=128 scontext=system_u:system_r:udev_t
tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1
avc: denied { open } for pid=55 comm="systemd-udevd"
path="/etc/systemd/network" dev="vda" ino=128
scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t
tclass=dir permissive=1
avc: denied { open } for pid=55 comm="systemd-udevd"
path="/etc/systemd/network" dev="vda" ino=128
scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t
tclass=dir permissive=1
avc: denied { getattr } for pid=59 comm="systemd-network"
path="/etc/systemd/network" dev="vda" ino=128
scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1
avc: denied { read } for pid=59 comm="systemd-network" name="network"
dev="vda" ino=128 scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1
avc: denied { open } for pid=59 comm="systemd-network"
path="/etc/systemd/network" dev="vda" ino=128
scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1
avc: denied { search } for pid=59 comm="systemd-network"
name="network" dev="vda" ino=128
scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1
avc: denied { getattr } for pid=55 comm="systemd-udevd"
path="/etc/systemd/network" dev="vda" ino=128
scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t
tclass=dir permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-09-18 14:34:34 +02:00
5c604e806b
logging: allow systemd-journal to write messages to the audit socket
...
Fixes:
avc: denied { nlmsg_write } for pid=46 comm="systemd-journal"
scontext=system_u:system_r:syslogd_t
tcontext=system_u:system_r:syslogd_t tclass=netlink_audit_socket
permissive=1
avc: denied { nlmsg_write } for pid=46 comm="systemd-journal"
scontext=system_u:system_r:syslogd_t
tcontext=system_u:system_r:syslogd_t tclass=netlink_audit_socket
permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-09-18 14:34:34 +02:00
8cb806fbdf
locallogin: allow login to get attributes of procfs
...
Fixes:
avc: denied { getattr } for pid=88 comm="login" name="/" dev="proc"
ino=1 scontext=system_u:system_r:local_login_t
tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-09-18 14:34:34 +02:00
7014af08ff
udev: allow udevadm to retrieve xattrs
...
Fixes:
avc: denied { getattr } for pid=50 comm="udevadm" name="/" dev="vda"
ino=2 scontext=system_u:system_r:udevadm_t
tcontext=system_u:object_r:fs_t tclass=filesystem permissive=0
avc: denied { getattr } for pid=52 comm="udevadm" name="/" dev="vda"
ino=2 scontext=system_u:system_r:udevadm_t
tcontext=system_u:object_r:fs_t tclass=filesystem permissive=0
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
2020-09-18 14:34:34 +02:00
2e5eefbfce
.travis.yml: Point selint at only the policy dir.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-09-17 09:58:02 -04:00
c33866e1f6
selinux, init, systemd, rpm: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-09-09 16:55:06 -04:00
4e2b3545c6
Merge pull request #308 from cgzones/systemd_status
2020-09-09 16:54:23 -04:00
24827d8073
selinux: add selinux_use_status_page and deprecate selinux_map_security_files
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-09-09 21:00:47 +02:00
a0aee3cbcc
bind: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-09-09 11:25:28 -04:00
93113bce78
bind: add a few fc specs for unbound
...
unbound-checkconf is the unbound bind-checkconf equivalent
unbound-control is the unbound bind ndc equivalent
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
2020-09-09 11:24:43 -04:00
1103350ee3
init/systemd: allow systemd to map the SELinux status page
...
systemd v247 will access the SELinux status page.
This affects all domains currently opening the label database, having
the permission seutil_read_file_contexts.
see https://github.com/systemd/systemd/pull/16821
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-09-08 13:18:18 +02:00
dcf7ae9f48
userdomain: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-08-31 15:36:14 -04:00
58ea9ac7c3
Merge pull request #303 from jpds/optional-userdomain-usbguard
2020-08-31 15:32:18 -04:00
9d3321e4fe
userdomain.if: Marked usbguard user modify tunable as optional so usbguard may be excluded.
...
Thanks to Dominick Grift for helping me pin-point this.
Signed-off-by: Jonathan Davies <jpds@protonmail.com>
2020-08-29 20:43:38 +00:00
72e221fd4d
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-08-28 15:30:52 -04:00
cc15ff2086
Merge pull request #302 from dsugar100/master
2020-08-28 15:26:50 -04:00
74b37e16db
Merge pull request #301 from bauen1/fix-selint-s-010
2020-08-28 15:26:47 -04:00
fa59d0e9bc
selint: fix S-010
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-08-28 17:39:09 +02:00
1627ab361e
Looks like this got dropped in pull request #294
...
Seeing the following denial - adding back in:
localhost kernel: type=1400 audit(1598497795.109:57): avc: denied { map } for pid=1054 comm="modprobe" path="/usr/lib/modules/3.10.0-1127.19.1.el7.x86_64/modules.dep.bin" dev="dm-0" ino=23711 scontext=system_u:system_r:kmod_t:s0 tcontext=system_u:object_r:modules_dep_t:s0 tclass=file permissive=0
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2020-08-27 08:10:58 -04:00
f8b0c1641c
acpi: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-08-26 12:52:59 -07:00
565f41e474
Merge pull request #299 from jpds/acpid_shutdown
2020-08-26 12:49:20 -07:00
3991ecf54f
Merge branch 'acpid_shutdown' of https://github.com/jpds/refpolicy into jpds-acpid_shutdown
2020-08-26 12:49:14 -07:00
d655ae7afa
Merge pull request #300 from cgzones/macro
...
postfixpolicyd: split multi-class rule
2020-08-26 15:29:52 -04:00
99ad371868
acpi.te: Removed unnecessary init_write_initctl().
...
Signed-off-by: Jonathan Davies <jpds@protonmail.com>
2020-08-25 22:53:40 +00:00
850fefc626
postfixpolicyd: split multi-class rule
...
The rule uses the permission manage_file_perms on the classes file and
sock_file. This won't result in a change in the actual policy
generated, but if the definitions of macros are changed going forward,
the mismatches could cause issues.
Found by SELint
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-08-25 20:44:16 +02:00
b172fd71d2
systemd-logind: utilize nsswitch
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-08-24 16:37:10 +02:00
69b709930a
authlogin: connect to userdb
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-08-24 16:37:10 +02:00
ada848b352
systemd: private type for /run/systemd/userdb
...
Signed-off-by: bauen1 <j2468h@gmail.com>
2020-08-24 16:37:07 +02:00
ec0ebc8b11
acpi.te: Allow acpid_t to shutdown the system - this is required to handle shutdown calls from libvirt. Fixes #298 .
...
Signed-off-by: Jonathan Davies <jpds@protonmail.com>
2020-08-23 20:00:29 +00:00
bdb9ffd00e
Update Changelog and VERSION for release.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-08-18 09:23:17 -04:00
d387e79989
Bump module versions for release.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-08-18 09:09:10 -04:00
Antoine Tenart
Deepak Rawat
Chris PeBenito
Dave Sugar
Yi Zhao
Christian Göttsche
Dominick Grift
Jonathan Davies
bauen1
Dave Sugar