nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6,199 Commits 1 Branch 0 Tags 16 MiB
9f4afcc6e2
Commit Graph

6199 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Kenton Groombridge
9f4afcc6e2 testing: accept '@' as a valid ending character in filecon checker 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-12-05 13:01:23 -05:00
Chris PeBenito
9788933467 ntp, samba: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2021-11-30 11:24:41 -05:00
Chris PeBenito
7dae637f4b Merge pull request #442 from yizhao1/samba 2021-11-30 11:23:59 -05:00
Yi Zhao
f24f38f0f2 ntp: allow ntpd to set rlimit_memlock 
Fixes:
ntpd[249]: Cannot set RLIMIT_MEMLOCK: Operation not permitted

avc:  denied  { sys_resource } for  pid=247 comm="ntpd" capability=24
scontext=system_u:system_r:ntpd_t:s0-s15:c0.c1023
tcontext=system_u:system_r:ntpd_t:s0-s15:c0.c1023 tclass=capability
permissive=0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-11-30 21:53:02 +08:00
Yi Zhao
5e7b58612e samba: fixes for smbd/nmbd 
* Do not audit capability net_admin for smbd_t/nmbd_t
* Allow nmbd_t to manage samba_var_t dirs

Fixes:
avc:  denied  { net_admin } for  pid=334 comm="smbd" capability=12
scontext=system_u:system_r:smbd_t tcontext=system_u:system_r:smbd_t
tclass=capability permissive=1

avc:  denied  { net_admin } for  pid=273 comm="nmbd" capability=12
scontext=system_u:system_r:nmbd_t tcontext=system_u:system_r:nmbd_t
tclass=capability permissive=1

avc:  denied  { create } for  pid=273 comm="nmbd" name="msg.lock"
scontext=system_u:system_r:nmbd_t tcontext=system_u:object_r:samba_var_t
tclass=dir permissive=1

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-11-30 21:52:43 +08:00
Chris PeBenito
0c6e887481 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2021-11-29 11:40:49 -05:00
Chris PeBenito
92da1b321b Merge pull request #441 from yizhao1/strongswan 2021-11-29 11:36:25 -05:00
Chris PeBenito
86931401b6 Merge pull request #438 from pebenito/auditd-stat-dispatched 2021-11-29 11:36:16 -05:00
Chris PeBenito
fd367d24eb Merge pull request #437 from pebenito/ntp-drift-symlink 2021-11-29 11:36:12 -05:00
Chris PeBenito
f3c10c83bd Merge pull request #436 from pebenito/udev-efi 2021-11-29 11:36:09 -05:00
Chris PeBenito
74b080fcaf Merge pull request #435 from pebenito/systemd-updates 2021-11-29 11:36:05 -05:00
Yi Zhao
9e71ad3551 ipsec: fixes for strongswan 
* Add fcontext for charon-systemd
* Allow ipsec_mgmt_t to list ipsec_conf_file_t dir
* Allow ipsec_mgmt_t to read cert files

Fixes:
avc:  denied  { search } for  pid=372 comm="swanctl" name="strongswan.d"
dev="vda" ino=1461
scontext=system_u:system_r:ipsec_mgmt_t:s0-s15:c0.c1023
tcontext=system_u:object_r:ipsec_conf_file_t:s0 tclass=dir permissive=0

avc:  denied  { read } for  pid=372 comm="swanctl" name="strongswan.d"
dev="vda" ino=1461
scontext=system_u:system_r:ipsec_mgmt_t:s0-s15:c0.c1023
tcontext=system_u:object_r:ipsec_conf_file_t:s0 tclass=dir permissive=0

avc:  denied  { getattr } for  pid=323 comm="swanctl"
path="/etc/ssl/openssl.cnf" dev="vda" ino=1463
scontext=system_u:system_r:ipsec_mgmt_t
tcontext=system_u:object_r:cert_t tclass=file permissive=0

avc:  denied  { open } for  pid=323 comm="swanctl"
path="/etc/ssl/openssl.cnf" dev="vda" ino=1463
scontext=system_u:system_r:ipsec_mgmt_t
tcontext=system_u:object_r:cert_t tclass=file permissive=0

avc:  denied  { read } for  pid=323 comm="swanctl" name="openssl.cnf"
dev="vda" ino=1463 scontext=system_u:system_r:ipsec_mgmt_t
tcontext=system_u:object_r:cert_t tclass=file permissive=0

avc:  denied  { search } for  pid=323 comm="swanctl" name="ssl"
dev="vda" ino=1202 scontext=system_u:system_r:ipsec_mgmt_t
tcontext=system_u:object_r:cert_t tclass=dir permissive=0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
 2021-11-29 16:38:12 +08:00
Chris PeBenito
7e3b26e76c logging: Allow auditd to stat() dispatcher executables. 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2021-11-18 16:37:01 -05:00
Chris PeBenito
89c83b8299 ntp: Handle symlink to drift directory. 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2021-11-18 16:35:56 -05:00
Chris PeBenito
bc51e2afe0 udev: Manage EFI variables. 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
 2021-11-18 16:34:54 -05:00
Chris PeBenito
51d0d6d15e logging: Add audit_control for journald. 
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2021-11-18 16:25:38 -05:00
Chris PeBenito
580c3da195 systemd: User runtime reads user cgroup files. 
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2021-11-18 16:25:35 -05:00
Chris PeBenito
c66fefcbf1 systemd: Revise tmpfiles factory to allow writing all configs. 
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2021-11-18 16:25:33 -05:00
Chris PeBenito
6ce1e64c49 systemd: Unit generator fixes. 
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2021-11-18 16:25:30 -05:00
Chris PeBenito
96ea14ed59 systemd, ssh, ntp: Read fips_enabled crypto sysctl. 
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
 2021-11-18 16:25:25 -05:00
Chris PeBenito
6eb1469ce7
Merge pull request #433 from 0xC0ncord/wine-roleattribute 
wine: fix roleattribute statement
 2021-11-18 14:30:57 -05:00
Kenton Groombridge
64380b4d33 wine: fix roleattribute statement 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-16 12:11:59 -05:00
Chris PeBenito
096eb775fa various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2021-11-15 15:34:27 -05:00
Chris PeBenito
55d91c13f3 Merge pull request #415 from 0xC0ncord/constraints-update 2021-11-15 15:34:06 -05:00
Chris PeBenito
af39a6ed86
Merge pull request #432 from vmojzis/warning 
Report warning on duplicate definition of interface
 2021-11-15 08:56:21 -05:00
Vit Mojzis
051d166cd0 Improve error message on duplicate definition of interface 
Specify which file contains the original definition.

Old:
 ipa.if:284: Error: duplicate definition of
  ipa_cert_filetrans_named_content(). Original definition on 284.
New:
 ipa.if:284: Error: duplicate definition of
  ipa_cert_filetrans_named_content(). Original definition on
  /usr/share/selinux/devel/include/contrib/ipa.if:284.

Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
 2021-11-15 10:23:48 +01:00
Chris PeBenito
47a229198d various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2021-11-14 18:57:40 -05:00
Chris PeBenito
e0d1b94c8e Merge pull request #412 from 0xC0ncord/bugfix/systemd-user-exec-apps-hookup 2021-11-14 18:57:19 -05:00
Kenton Groombridge
a29cb4a2b3 guest, xguest: remove apache role access 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-12 14:57:36 -05:00
Kenton Groombridge
5ea601c011 mcs: only constrain mcs_constrained_type for db accesses 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 13:59:08 -05:00
Kenton Groombridge
b006b259f4 mcs: constrain context contain access 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 13:56:27 -05:00
Kenton Groombridge
e701e18e7f corenet: make netlabel_peer_t mcs constrained 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 13:55:30 -05:00
Kenton Groombridge
e7fb65980f various: deprecate mcs override interfaces 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 13:55:26 -05:00
Kenton Groombridge
10bfc890d2 mcs: combine single-level object creation constraints 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 13:55:18 -05:00
Kenton Groombridge
d355d046d2 mcs: constrain misc IPC objects 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 13:55:12 -05:00
Kenton Groombridge
814d4d3f38 mcs: add additional constraints to databases 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 13:55:09 -05:00
Chris PeBenito
2d371fcee2 various: Module version bump. 
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
 2021-11-09 11:13:37 -05:00
Chris PeBenito
9369323629 Merge pull request #429 from 0xC0ncord/various-20211106 2021-11-09 11:13:21 -05:00
Kenton Groombridge
b24d350780 spamassassin: fix file contexts for rspamd symlinks 
rspamd installs symlinks to /usr/bin that point to the real rspam*
binaries. Make these files bin_t so that other programs can read them
without any additional access needed.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
282c291cb2 policykit, systemd: allow policykit to watch systemd logins and sessions 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
2e6cc2d281 netutils: fix ping 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
ae0a8b7fba bind: fixes for unbound 
Unbound maintains a copy of the root key in /etc/unbound/cache and needs
to be able to manage it.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
60d3cf03ed asterisk: allow reading generic certs 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
82767eaade sysadm, systemd: fixes for systemd-networkd 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
397d4a379f ssh: fix for polyinstantiation 
If using polyinstantiation, sshd needs to be able to create a new tmp
directory for remote users.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
19d787597f usbguard, sysadm: misc fixes 
Fixes for usbguard and allow sysadm to connect to usbguard to manage
devices at runtime.

Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:48 -05:00
Kenton Groombridge
2d33258db7 certbot, various: allow various services to read certbot certs 
Signed-off-by: Kenton Groombridge <me@concord.sh>
 2021-11-09 11:05:44 -05:00
Chris PeBenito
85a3e84a92 Merge pull request #431 from 0xC0ncord/git-type 2021-11-09 11:01:59 -05:00
Chris PeBenito
8500c2da93 Merge pull request #430 from jpds/virt-common-fix 2021-11-09 11:01:42 -05:00
Chris PeBenito
959ad8ad4d Merge pull request #428 from cgzones/install-headers 2021-11-09 11:01:31 -05:00