nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
4,827 Commits 1 Branch 0 Tags 16 MiB
e8ba31557d
Commit Graph

464 Commits

Author SHA1 Message Date
Chris PeBenito
e8ba31557d various: Module version bump. 2019-01-06 14:11:08 -05:00
Sugar, David
82494cedc1 pam_faillock creates files in /run/faillock 
These are changes needed when pam_fallock creates files in /run/faillock
(which is labeled faillog_t).  sudo and xdm (and probably other domains)
will create files in this directory for successful and failed login
attempts.

v3 - Updated based on feedback

type=AVC msg=audit(1545153126.899:210): avc:  denied  { search } for pid=8448 comm="lightdm" name="faillock" dev="tmpfs" ino=39318 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545153131.090:214): avc:  denied  { write } for pid=8448 comm="lightdm" name="faillock" dev="tmpfs" ino=39318 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545153131.090:214): avc:  denied  { add_name } for pid=8448 comm="lightdm" name="dsugar" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545153131.090:214): avc:  denied  { create } for pid=8448 comm="lightdm" name="dsugar" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=file permissive=1
type=AVC msg=audit(1545153131.091:215): avc:  denied  { setattr } for pid=8448 comm="lightdm" name="dsugar" dev="tmpfs" ino=87599 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=file permissive=1

type=AVC msg=audit(1545167205.531:626): avc:  denied  { search } for pid=8264 comm="sudo" name="faillock" dev="tmpfs" ino=35405 scontext=sysadm_u:sysadm_r:cleaner_applyconfig_sudo_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545167205.531:627): avc:  denied  { write } for pid=8264 comm="sudo" name="faillock" dev="tmpfs" ino=35405 scontext=sysadm_u:sysadm_r:cleaner_applyconfig_sudo_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545167205.531:627): avc:  denied  { add_name } for pid=8264 comm="sudo" name="root" scontext=sysadm_u:sysadm_r:cleaner_applyconfig_sudo_t:s0-s0:c0.c1023 tcontext=system_u:object_r:faillog_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1545167205.531:627): avc:  denied  { create } for pid=8264 comm="sudo" name="root" scontext=sysadm_u:sysadm_r:cleaner_applyconfig_sudo_t:s0-s0:c0.c1023 tcontext=sysadm_u:object_r:faillog_t:s0 tclass=file permissive=1

Signed-off-by: Dave Sugar <dsugar@tresys.com>
 2019-01-06 13:57:18 -05:00
Russell Coker
b77b4cd610 missing from previous 
Here are the things that weren't applied from my previous patches, I think they
are all worthy of inclusion.
 2019-01-06 13:44:18 -05:00
Russell Coker
ef6c7f155e systemd misc 
This patch has policy changes related to systemd and the systemd versions
of system programs.

Also has some dbus policy which probably isn't strictly a systemd thing, but it
all came at the same time.
 2019-01-06 13:11:51 -05:00
Chris PeBenito
d6b46686cd many: Module version bumps for changes from Russell Coker. 2019-01-05 14:33:50 -05:00
Chris PeBenito
da9ff19d94 sudo: Whitespace fix. 2019-01-05 14:17:18 -05:00
Russell Coker
e1babbc375 systemd related interfaces 
This patch has interface changes related to systemd support as well as policy
that uses the new interfaces.
 2019-01-05 14:17:01 -05:00
Chris PeBenito
6f12a29ecc apt, rpm: Remove and move lines to fix fc conflicts. 2019-01-05 14:09:57 -05:00
Chris PeBenito
39881a0e14 dpkg: Rename dpkg_read_script_tmp_links(). 2019-01-05 13:56:43 -05:00
Russell Coker
5125b8eb2d last misc stuff 
More tiny patches.  Note that this and the other 2 patches I just sent are not
dependent on each other, please apply any that you like.
 2019-01-05 13:54:38 -05:00
Russell Coker
73f8b85ef3 misc interfaces 
This patch has some small interface changes as well as the policy patches to
use the new interfaces.
 2019-01-05 13:36:20 -05:00
Chris PeBenito
e3eba7b7ff logrotate: Module version bump. 2018-10-13 13:39:18 -04:00
Luis Ressel
14b4c0c8c7 Realign logrotate.fc, remove an obvious comment 2018-10-13 13:39:18 -04:00
Luis Ressel
a604ae7ca2 Add fc for /var/lib/misc/logrotate.status 
Some distros configure logrotate to put its status file somewhere else
than the default /var/lib/logrotate.status. Debian puts it in
/var/lib/logrotate/, and Gentoo uses /var/lib/misc/.
 2018-10-13 13:39:18 -04:00
Chris PeBenito
65e8f758ca Bump module versions for release. 2018-07-01 11:02:33 -04:00
Chris PeBenito
3ab07a0e1e Move all files out of the old contrib directory. 2018-06-23 10:38:58 -04:00
Chris PeBenito
4d5b06428b Bump module versions for release. 2018-01-14 14:08:09 -05:00
Chris PeBenito
f522bc0b75 dmesg, locallogin, modutils: Module version bump. 2017-11-18 07:32:37 -05:00
Luis Ressel
96c917b41a dmesg: Grant read access to /usr/share/terminfo 
To determine whether the $TERM supports colored output, dmesg checks the
terminfo database, which can be either in /etc or /usr/share.
 2017-11-18 05:53:50 -05:00
Chris PeBenito
d2e201495a files, netutils: Module version bump. 2017-10-25 17:21:31 -04:00
Luis Ressel via refpolicy
68690d8e62 netutils: Grant netutils_t map perms for the packet_socket class 
This is required for the PACKET_RX_RING feature used by tcpdump.
 2017-10-25 17:16:06 -04:00
Chris PeBenito
495e2c203b Remove complement and wildcard in allow rules. 
Remove complement (~) and wildcard (*) in allow rules so that there are no
unintentional additions when new permissions are declared.

This patch does not add or remove permissions from any rules.
 2017-08-13 16:21:44 -04:00
Chris PeBenito
aa0eecf3e3 Bump module versions for release. 2017-08-05 12:59:42 -04:00
Chris PeBenito
4680d9c659 netutils: Module version bump for patch from Luis Ressel. 2017-06-18 19:26:29 -04:00
Luis Ressel
b6fe74c67c netutils: Allow tcpdump to reduce its capability bounding set 2017-06-18 19:23:21 -04:00
Luis Ressel
261e2772d1 netutils: Add some permissions required by nmap to traceroute_t 
nmap currently also needs "self:socket create", but I've submitted a
kernel patch to ameliorate this.
 2017-06-18 19:23:13 -04:00
Luis Ressel
afe26f2e2f netutils: Mix nmap perms in with the other traceroute_t perms 2017-06-18 19:23:02 -04:00
Chris PeBenito
6293813020 Module version bump for patches from cgzones. 2017-06-12 18:48:58 -04:00
cgzones
ea74a35ba7 netutils: update 
v2:
 - keep files_read_etc_files interfaces
 2017-06-12 18:41:56 -04:00
Chris PeBenito
a599f28196 Module version bump for /usr/bin fc fixes from Nicolas Iooss. 2017-05-04 08:27:46 -04:00
Chris PeBenito
8ab6ff00f6 Merge branch 'usr_bin_fc' of git://github.com/fishilico/selinux-refpolicy-patched 2017-05-04 08:20:42 -04:00
Chris PeBenito
bb8f9f49c3 little misc strict from Russell Coker. 2017-04-29 11:25:13 -04:00
Chris PeBenito
878735f69f Module version bump for patches from Russell Coker and Guido Trentalancia. 2017-04-26 06:39:39 -04:00
Chris PeBenito
8f6f0cf0e2 Rename apm to acpi from Russell Coker. 
This patch is slightly more involved than just running sed.  It also adds
typealias rules and doesn't change the FC entries.

The /dev/apm_bios device doesn't exist on modern systems.  I have left that
policy in for the moment on the principle of making one change per patch.  But
I might send another patch to remove that as it won't exist with modern
kernels.
 2017-04-26 06:36:20 -04:00
Chris PeBenito
57bb7dd471 another bootloader patch from Russell Coker 2017-04-18 21:30:02 -04:00
Chris PeBenito
132cc4b2d5 bootloader from Russell Coker. 
This patch adds a lot of policy that is needed to setup an initramfs and grub
on Debian nowadays.

Also changed a comment about ia64 to correctly mention EFI.
 2017-04-18 20:56:59 -04:00
Chris PeBenito
b49d85c83d misc daemons from Russell Coker. 
Put in libx32 subs entries that refer to directories with fc entries.

Allow dpkg_t to transition to dpkg_script_t when it executes bin_t for
dpkg-reconfigure.

Some dontaudit rules for mta processes spawned by mon for notification.

Lots of tiny changes that are obvious.
 2017-04-18 20:38:13 -04:00
Nicolas Iooss
69c742f11b
Support systems with a single /usr/bin directory 
On systems such as Arch Linux, all programs which are usually located in
/bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the
other locations are symbolic links to this directory.  With such a
configuration, the file contexts which define types for files in
/bin, /sbin and /usr/sbin need to be duplicated to provide definitions
for /usr/bin/...

As the "/bin vs. /usr/bin" part of the needed definitions has already
been done with the "usr merge" patches, the next step consists in
duplicating file contexts for /usr/sbin. This is what this patch does
for all modules which are not in contrib.

This is the second iteration of an idea I have previously posted on
http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
 2017-04-15 20:49:07 +02:00
Chris PeBenito
4d028498d8 Module version bumps for fixes from cgzones. 2017-03-05 10:48:42 -05:00
Chris PeBenito
919a478e47 Merge branch 'fix_usr_bin_merge' of git://github.com/cgzones/refpolicy 2017-03-05 09:43:50 -05:00
cgzones
4b79a54b41 modutils: adopt callers to new interfaces 2017-03-03 12:28:17 +01:00
cgzones
d2702a4224 corecmd_read_bin_symlinks(): remove deprecated and redundant calls 2017-03-03 12:00:07 +01:00
Chris PeBenito
ca04cdb14b Module version bump for patches from cgzones. 2017-02-26 12:23:19 -05:00
Chris PeBenito
10388e1319 auth: Move optional out of auth_use_pam_systemd() to callers. 2017-02-26 12:08:02 -05:00
Chris PeBenito
2170c65ad9 Merge branch 'su_module' of git://github.com/cgzones/refpolicy 2017-02-26 11:48:37 -05:00
Chris PeBenito
53fb3a3ba4 dpkg: Updates from Russell Coker. 2017-02-19 16:13:14 -05:00
cgzones
ba0e51c5b0 su: some adjustments 
* systemd fixes
* remove unused attribute su_domain_type
* remove hide_broken_symptoms sections
* dontaudit init_t proc files access
* dontaudit net_admin capability due to setsockopt
 2017-02-18 21:50:45 +01:00
Chris PeBenito
1720e109a3 Sort capabilities permissions from Russell Coker. 2017-02-15 18:47:33 -05:00
Chris PeBenito
e9b2a7943c Module version bump for bootloader patch revert. Plus compat alias. 2017-02-11 14:51:21 -05:00
Chris PeBenito
0e80a8a7cf Revert "bootloader: stricter permissions and more tailored file contexts" 
This reverts commit b0c13980d2.
 2017-02-11 14:26:48 -05:00