nnd
/
selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update policy for selinux userspace moving the policy store to /var/lib/selinux 

With the new userspace, the only files in /var/lib/selinux are selinux
store related files, so label it and everything inside it as
semanage_store_t. semanage_var_lib_t is completely removed and now
aliases semanage_store_t for backwards compatibility. This differs from
the v2 patch in that it adds back the ability to manage
selinux_config_t, which is necessary to manage the old module store for
things like migrating from the old to new store and backwards
compatability.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
This commit is contained in:
Steve Lawrence 2014-12-03 09:55:26 -05:00 committed by Chris PeBenito
parent 3e3a966eea
commit 418b3c78bb
3 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
policy/modules/system/selinuxutil.fc
View File

@ -41,11 +41,14 @@
/usr/sbin/setsebool -- gen_context(system_u:object_r:semanage_exec_t,s0) /usr/sbin/setsebool -- gen_context(system_u:object_r:semanage_exec_t,s0)
/usr/sbin/semanage -- gen_context(system_u:object_r:semanage_exec_t,s0) /usr/sbin/semanage -- gen_context(system_u:object_r:semanage_exec_t,s0)
/usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0) /usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0)
/usr/libexec/selinux/semanage_migrate_store -- gen_context(system_u:object_r:semanage_exec_t,s0)
# #
# /var/lib # /var/lib
# #
/var/lib/selinux(/.*)? gen_context(system_u:object_r:semanage_var_lib_t,s0) /var/lib/selinux(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
/var/lib/selinux/[^/]+/semanage\.read\.LOCK -- gen_context(system_u:object_r:semanage_read_lock_t,s0)
/var/lib/selinux/[^/]+/semanage\.trans\.LOCK -- gen_context(system_u:object_r:semanage_trans_lock_t,s0)
# #
# /var/run # /var/run

2
policy/modules/system/selinuxutil.if
View File

@ -1041,7 +1041,9 @@ interface(`seutil_manage_module_store',`
') ')
files_search_etc($1) files_search_etc($1)
files_search_var($1)
manage_dirs_pattern($1, selinux_config_t, semanage_store_t) manage_dirs_pattern($1, selinux_config_t, semanage_store_t)
manage_dirs_pattern($1, semanage_store_t, semanage_store_t)
manage_files_pattern($1, semanage_store_t, semanage_store_t) manage_files_pattern($1, semanage_store_t, semanage_store_t)
manage_lnk_files_pattern($1, semanage_store_t, semanage_store_t) manage_lnk_files_pattern($1, semanage_store_t, semanage_store_t)
') ')

8
policy/modules/system/selinuxutil.te
View File

@ -100,7 +100,7 @@ application_domain(semanage_t, semanage_exec_t)
domain_interactive_fd(semanage_t) domain_interactive_fd(semanage_t)
role semanage_roles types semanage_t; role semanage_roles types semanage_t;
type semanage_store_t; type semanage_store_t alias semanage_var_lib_t;
files_type(semanage_store_t) files_type(semanage_store_t)
type semanage_read_lock_t; type semanage_read_lock_t;
@ -112,9 +112,6 @@ files_tmp_file(semanage_tmp_t)
type semanage_trans_lock_t; type semanage_trans_lock_t;
files_type(semanage_trans_lock_t) files_type(semanage_trans_lock_t)
type semanage_var_lib_t;
files_type(semanage_var_lib_t)
type setfiles_t alias restorecon_t, can_relabelto_binary_policy; type setfiles_t alias restorecon_t, can_relabelto_binary_policy;
type setfiles_exec_t alias restorecon_exec_t; type setfiles_exec_t alias restorecon_exec_t;
init_system_domain(setfiles_t, setfiles_exec_t) init_system_domain(setfiles_t, setfiles_exec_t)
@ -454,9 +451,6 @@ allow semanage_t semanage_tmp_t:dir manage_dir_perms;
allow semanage_t semanage_tmp_t:file manage_file_perms; allow semanage_t semanage_tmp_t:file manage_file_perms;
files_tmp_filetrans(semanage_t, semanage_tmp_t, { file dir }) files_tmp_filetrans(semanage_t, semanage_tmp_t, { file dir })
manage_dirs_pattern(semanage_t, semanage_var_lib_t, semanage_var_lib_t)
manage_files_pattern(semanage_t, semanage_var_lib_t, semanage_var_lib_t)
kernel_read_system_state(semanage_t) kernel_read_system_state(semanage_t)
kernel_read_kernel_sysctls(semanage_t) kernel_read_kernel_sysctls(semanage_t)