nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
5,631 Commits 1 Branch 0 Tags 16 MiB
71e653980b
Commit Graph

1554 Commits

Author SHA1 Message Date
Chris PeBenito
71e653980b various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-08-11 08:35:00 -04:00
Chris PeBenito
cd141fa2ea Merge pull request #290 from pebenito/fs-image 2020-08-11 08:33:26 -04:00
Chris PeBenito
32b2332d36 Merge pull request #289 from pebenito/remove-unlabeled-file 2020-08-11 08:33:22 -04:00
Chris PeBenito
777fe47c19 kernel, fstools, lvm, mount: Update to use filesystem image interfaces. 
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2020-07-29 14:33:39 -04:00
Chris PeBenito
fe737c405d selinuxuntil, userdomain: Restore relabelfrom access for unlabeled files. 
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2020-07-28 10:33:07 -04:00
Chris PeBenito
4c7926a3c0 init: Revise init_startstop_service() build option blocks. 
Revise to use ifelse to have a clear set of criteria for enabling the
various options.  Additionally, if no options are enabled, run_init
permissions are provided as a default.

Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2020-07-27 11:40:36 -04:00
Chris PeBenito
613708cad6 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-07-04 09:30:45 -04:00
Chris PeBenito
0992763548 Update callers for "pid" to "runtime" interface rename. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-06-28 16:03:45 -04:00
Chris PeBenito
be04bb3e7e Rename "pid" interfaces to "runtime" interfaces. 
Rename interfaces to bring consistency with previous pid->runtime type
renaming.  See PR #106 or 69a403cd original type renaming.

Interfaces that are still in use were renamed with a compatibility
interface.  Unused interfaces were fully deprecated for removal.

Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-06-28 14:33:17 -04:00
Chris PeBenito
c63e5410a9 systemd: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-06-17 08:48:41 -04:00
Chris PeBenito
c2a142d762 systemd: Merge generator domains. 
If these processes are compromised they can write units to do malicious
actions, so trying to tightly protect the resources for each generator
is not effective.

Made the fstools_exec() optional, although it is unlikely that a system
would not have the module.

Only aliases for removed types in previous releases are added.  The
systemd_unit_generator() interface and systemd_generator_type attribute
were not released and are dropped without deprecation.

Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-06-15 09:47:20 -04:00
Chris PeBenito
71002cdfe0 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-06-15 08:57:44 -04:00
Chris PeBenito
91087f8ff1 Merge pull request #274 from bauen1/remove-dead-weight 2020-06-15 08:56:42 -04:00
Chris PeBenito
9169113d42 Merge pull request #271 from bauen1/misc-fixes-2 2020-06-15 08:56:40 -04:00
Chris PeBenito
edbe7e9af7 Merge pull request #267 from bauen1/target-systemd-sysusers 2020-06-15 08:56:24 -04:00
bauen1
fc904634ac
dpkg: domaintrans to sysusers if necessary 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-15 14:52:53 +02:00
bauen1
77f891c7bf
Remove the ada module, it is unecessary and not touched since ~2008 
It is only used to allow the compiler execmem / execstack but we have
unconfined_execmem_t for that.

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-15 14:47:14 +02:00
bauen1
cbdf1fad22
systemd: systemd-tempfiles will relabel tmpfs if mounted over e.g. /tmp 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-15 14:45:07 +02:00
bauen1
583f435c7b
systemd: systemd --user add essential permissions 
Allow selinux awareness (libselinux) and access to setsockcreatecon to
correctly set the label of sockets.

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-15 14:45:07 +02:00
Chris PeBenito
2f097a0c6d various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-06-15 08:43:30 -04:00
bauen1
66b4101b36
systemd: maintain /memfd:systemd-state 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-15 14:43:18 +02:00
bauen1
a42a15dd4d
authlogin: unix_chkpwd is linked to libselinux 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-15 14:43:18 +02:00
bauen1
6f7bc3da46
init: systemd will run chkpwd to start user@1000 
This was likely also hidden by the unconfined module.

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-15 14:43:17 +02:00
bauen1
6ce9865e6c
systemd: fixed systemd_rfkill_t denial spam 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-15 14:41:30 +02:00
bauen1
0f4eb2a324
init: fix systemd boot 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-11 19:10:35 +02:00
bauen1
93beef3ce5
systemd-logind.service sandbox required permissions 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-11 19:10:35 +02:00
bauen1
e20db26b7b
systemd-timesyncd.service sandbox requried permissions 
For every services sandbox systemd will create a (or more ?) tmpfs including symlinks for various files, e.g.:

Jun 11 14:03:17 selinux-pr-test1 audit[284]: AVC avc:  granted  { create } for  pid=284 comm="(imesyncd)" name="stderr" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=lnk_file

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-11 19:10:35 +02:00
bauen1
aa6c7f28f2
allow most common permissions for systemd sandboxing options 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-11 19:10:28 +02:00
Chris PeBenito
309f655fdc various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-06-10 15:02:27 -04:00
bauen1
8f782ae820
systemd-sysusers: add policy 
On systems without the unconfined module this service needs additional
privileges.

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-06-04 19:53:47 +02:00
Topi Miettinen
1d8333d7a7
Remove unlabeled packet access 
When SECMARK or Netlabel packet labeling is used, it's useful to
forbid receiving and sending unlabeled packets. If packet labeling is
not active, there's no effect.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-06-03 23:16:19 +03:00
Chris PeBenito
b38804e328 init, logging: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-05-27 11:36:44 -04:00
Chris PeBenito
fe0a8d2542 Merge pull request #261 from bauen1/confined-debian-fixes 2020-05-27 11:35:49 -04:00
bauen1
be231899f5
init: replace call to init_domtrans_script 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-05-27 17:09:06 +02:00
Chris PeBenito
c75b2f3642 corecommands, files, filesystem, init, systemd: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-05-27 10:52:49 -04:00
Chris PeBenito
d8da662d5e Merge pull request #262 from bauen1/misc-fixes-1 2020-05-27 10:52:07 -04:00
Chris PeBenito
382c5f7c09 domain, setrans: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-05-27 10:46:47 -04:00
bauen1
b184f71bed
init: fix init_manage_pid_symlinks to grant more than just create permissions 
This was introduced in 4e842fe209 by me.

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-05-27 14:23:18 +02:00
bauen1
ab2c353048
systemd: allow systemd-user-runtime-dir to do its job 
It requires access to /run/user/UID while running as root

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-05-27 14:03:05 +02:00
bauen1
7eae84a8b4
lvm-activation-generator also needs to execute lvm 
lvm will also try to read localization.

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-05-27 14:03:05 +02:00
bauen1
ef0238d2d5
init: watch /etc/localtime even if it's a symlink 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-05-27 11:51:36 +02:00
bauen1
9e2e343989
setrans: allow label translation for all domains. 
This partially reverts commit 65da822c1b
Connecting to setransd is still very much necessary for any domain that
uses SELinux labels in any way.

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-05-22 20:53:47 +02:00
bauen1
8784dd0c66
init: allow systemd to activate journald-audit.socket 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-05-22 20:51:46 +02:00
bauen1
5fb8157616
init: make initrc_t a init_domain to simplify the policy 
This also allows init_t initrc_t:process2 nnp_transition which can be
required if the service isn't targeted.

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-05-22 20:51:39 +02:00
bauen1
51d76f956f
init: allow systemd to setup mount namespaces 
This is required to boot without the unconfined module.

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-05-22 20:48:13 +02:00
Chris PeBenito
5b171c223a various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2020-05-14 10:32:30 -04:00
Chris PeBenito
28bf3cb4fb Merge pull request #258 from bauen1/misc-fixes-1 2020-05-14 10:27:04 -04:00
Chris PeBenito
2ab326ab2d Merge pull request #253 from cgzones/selint 2020-05-14 10:27:00 -04:00
bauen1
096b8f59f2
semanage: create directories for new policies 
semodule will try to create a directory under /etc/selinux if the policy
it is modifying doesn't exist (e.g. it is being build for the first time).

Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-05-14 09:31:31 +02:00
bauen1
4f9772e309
systemd-fstab-generator needs to know about all mountpoints 
Signed-off-by: bauen1 <j2468h@gmail.com>
 2020-05-14 09:31:30 +02:00