nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
5,759 Commits 1 Branch 0 Tags 16 MiB
bb471c3f1c
Commit Graph

334 Commits

Author SHA1 Message Date
Chris PeBenito
bb471c3f1c various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2021-01-13 15:20:47 -05:00
Chris PeBenito
6c69f6e3de udev: Drop udev_tbl_t. 
This usage under /dev/.udev has been unused for a very long time and
replaced by functionality in /run/udev.  Since these have separate types,
take this opportunity to revoke these likely unnecessary rules.

Fixes #221

Derived from Laurent Bigonville's work in #230

Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2021-01-13 15:12:11 -05:00
Chris PeBenito
72e221fd4d various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-08-28 15:30:52 -04:00
Chris PeBenito
74b37e16db Merge pull request #301 from bauen1/fix-selint-s-010 2020-08-28 15:26:47 -04:00
bauen1
fa59d0e9bc
selint: fix S-010 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-08-28 17:39:09 +02:00
Chris PeBenito
d387e79989 Bump module versions for release. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-08-18 09:09:10 -04:00
Yi Zhao
8322f0e0d9 Remove duplicated rules 
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2020-08-14 10:55:31 +08:00
Chris PeBenito
fbc60f2319
Merge pull request #296 from cgzones/diff-check 
whitespace cleanup
 2020-08-13 09:19:48 -04:00
Christian Göttsche
72b2c66256 whitespace cleanup 
Remove trailing white spaces and mixed up indents

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2020-08-13 14:34:57 +02:00
Christian Göttsche
3bb507efa6 Fix several misspellings 
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2020-08-13 14:08:58 +02:00
Chris PeBenito
613708cad6 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-07-04 09:30:45 -04:00
Chris PeBenito
0992763548 Update callers for "pid" to "runtime" interface rename. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-06-28 16:03:45 -04:00
Chris PeBenito
be04bb3e7e Rename "pid" interfaces to "runtime" interfaces. 
Rename interfaces to bring consistency with previous pid->runtime type
renaming.  See PR #106 or 69a403cd original type renaming.

Interfaces that are still in use were renamed with a compatibility
interface.  Unused interfaces were fully deprecated for removal.

Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-06-28 14:33:17 -04:00
Chris PeBenito
71002cdfe0 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-06-15 08:57:44 -04:00
Chris PeBenito
91087f8ff1 Merge pull request #274 from bauen1/remove-dead-weight 2020-06-15 08:56:42 -04:00
bauen1
77f891c7bf
Remove the ada module, it is unecessary and not touched since ~2008 
It is only used to allow the compiler execmem / execstack but we have
unconfined_execmem_t for that.

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-15 14:47:14 +02:00
bauen1
cb2d84b0d1
gpg: don't allow gpg-agent to read /proc/kcore 
This was probably a typo and shouldn't have been merged.

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-15 14:45:07 +02:00
bauen1
a5c3c70385
thunderbird: label files under /tmp 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-15 14:43:17 +02:00
Chris PeBenito
309f655fdc various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-06-10 15:02:27 -04:00
Topi Miettinen
1d8333d7a7
Remove unlabeled packet access 
When SECMARK or Netlabel packet labeling is used, it's useful to
forbid receiving and sending unlabeled packets. If packet labeling is
not active, there's no effect.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-06-03 23:16:19 +03:00
Chris PeBenito
5b171c223a various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-05-14 10:32:30 -04:00
Christian Göttsche
57d570f01c chromium/libraries: move lib_t filecontext to defining module 
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2020-05-12 20:09:44 +02:00
Christian Göttsche
31153edcb4 chromium: drop dead conditional block 
The condition `use_alsa` is nowhere defined, and the contained interface
`alsa_domain` does not exist.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
 2020-05-11 21:42:50 +02:00
Chris PeBenito
4ae3713c45 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-05-04 08:55:09 -04:00
Daniel Burgener
5ba931d49d Fix a few places where command line applications were only granted one of tty or pty permissions and could be used from either 
Signed-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com>
 2020-04-30 14:53:31 -04:00
Chris PeBenito
d401ff2a21 systemd, ssh, wm: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-04-24 10:22:30 -04:00
Topi Miettinen
352249fc05
wm: add KWin 
Add KWin to list of window managers and allow it to mmap wm_tmpfs_t
files to avoid a crash. Related audit event:
type=AVC msg=audit(04/24/2020 15:39:25.287:679) : avc:  denied  { map } for  pid=1309 comm=kwin_x11 path=/memfd:JSVMStack:/lib/x86_64-linux-gnu/libQt5Qml.so.5 (deleted) dev="tmpfs" ino=45261 scontext=user_u:user_r:user_wm_t:s0 tcontext=user_u:object_r:wm_tmpfs_t:s0 tclass=file permissive=0

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-04-24 16:19:51 +03:00
Chris PeBenito
24e1e2c8a3 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-04-21 11:03:01 -04:00
Chris PeBenito
549bb857c0 Merge pull request #220 from dburgener/fix-macro-usage 2020-04-21 11:01:59 -04:00
Daniel Burgener
410a682138 Fix mismatches between object class and permission macro. 
In many cases, this won't result in a change in the actual policy generated, but if the definitions of macros are changed going forward, the mismatches could cause issues.

Signed-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com>
 2020-04-20 15:46:33 -04:00
Chris PeBenito
acd45b66b4 mozilla, mailman, init, modutils: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-04-14 14:16:49 -04:00
bauen1
a4903dbf5b
mozilla: allow firefox to use user namespaces for sandboxing 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-04-14 19:34:54 +02:00
Chris PeBenito
5a9e52f328 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-04-09 09:41:05 -04:00
Chris PeBenito
5dbdce80f5 pulseaudio: Drop call to nonexistant interface. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-04-09 09:40:22 -04:00
Russell Coker
886aa39bfb pulseaudio patch 
Patch for pulseaudio against latest GIT

Signed-off-by: Russell Coker <russell@coker.com.au>
 2020-04-09 09:26:31 -04:00
Daniel Burgener
6409045cdc Change incorrect template definitions into interface definitions 
Signed-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com>
 2020-03-28 14:08:57 -04:00
Chris PeBenito
b2cc317a64 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-03-19 14:07:12 -04:00
Chris PeBenito
ecfaae80de Merge pull request #192 from topimiettinen/raw_memory_access_boolean 2020-03-19 13:07:57 -04:00
Chris PeBenito
b3959fb415 Merge pull request #196 from gtrentalancia/watch-perms 2020-03-19 13:05:42 -04:00
Guido Trentalancia
77174969ba wm: add watch perms 
Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
--
 policy/modules/apps/wm.if                 |    4 ++++
 policy/modules/services/networkmanager.if |   18 ++++++++++++++++++
 2 files changed, 22 insertions(+)
 2020-03-19 05:41:43 +01:00
Guido Trentalancia
0cd4068aea mozilla: add watch perms 
Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
--
 policy/modules/apps/mozilla.te |    2 ++
 1 file changed, 2 insertions(+)
 2020-03-19 05:41:43 +01:00
Topi Miettinen
bfb4e60edb
Make raw memory access tunable 
Modern systems shouldn't need direct access to raw memory
devices (/dev/mem, /dev/kmem, /dev/mergemem, dev/oldmem, /dev/port)
anymore, so let's remove the access in most cases and make it tunable
in the rest.

Add dev_read_raw_memory_cond(), dev_write_raw_memory_cond() and
dev_wx_raw_memory_cond(), which are conditional to new boolean
allow_raw_memory_access.

Remove raw memory access for a few domains that should never have
needed it (colord_t, iscsid_t, mdamd_t, txtstat_t), should not need it
anymore (dmidecode_t, Debian devicekit_diskt_t, hald_t, hald_mac_t,
xserver_t) or the domains that should transition to different domain
for this (rpm_t, kudzu_t, dpkg_t).

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-16 14:06:16 +02:00
Chris PeBenito
b2f72e833b Bump module versions for release. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-02-29 16:54:39 -05:00
Chris PeBenito
2400f6a74c various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-02-17 13:34:06 -05:00
Jason Zaman
8742aa4e3e gpg: add watch perms for agent 
avc:  denied  { watch } for  pid=10668 comm="gpg-agent" path="/run/user/1000/gnupg" dev="tmpfs" ino=21988 scontext=staff_u:staff_r:gpg_agent_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:gpg_runtime_t:s0 tclass=dir permissive=0
avc:  denied  { watch } for  pid=10668 comm="gpg-agent" path="/home/jason/.gnupg" dev="zfs" ino=34432 scontext=staff_u:staff_r:gpg_agent_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:gpg_secret_t:s0 tclass=dir permissive=0
Signed-off-by: Jason Zaman <jason@perfinion.com>
 2020-02-17 13:25:59 -05:00
Jason Zaman
509a639deb chromium: watch etc dirs 
avc:  denied  { watch } for  pid=44464 comm="ThreadPoolForeg" path="/etc" dev="zfs" ino=1436 scontext=staff_u:staff_r:chromium_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0
Signed-off-by: Jason Zaman <jason@perfinion.com>
 2020-02-17 13:25:59 -05:00
Chris PeBenito
0d4e919176 loadkeys, init, systemd, udev: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-02-11 13:13:20 -05:00
Chris PeBenito
353a19d088 Merge pull request #134 from bauen1/console-setup 2020-02-11 13:03:27 -05:00
bauen1
c8d921833c
loadkeys: remove redundant ifdef 2020-02-08 16:07:32 +01:00
bauen1
a573ef35af
udev: run consolesetup 2020-02-04 19:34:57 +01:00