From 0e84535c7a241fc32f4b904f019c807843dbb1a4 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Nov 20 2015 09:09:52 +0000 Subject: - Allow antivirus_t to bind to all unreserved ports. Clamd binds to random unassigned port (by default in range 1024-2048) - Allow abrt-hook-ccpp to change SELinux user identity for created objects. - Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern. - Allow setuid/setgid capabilities for abrt-hook-ccpp. - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.conf. - Allow fenced node dbus msg when using foghorn witch configured foghorn, snmpd, and snmptrapd. - cockpit has grown content in /var/run directory - Add support for /dev/mptctl device used to check RAID status. - Allow systemd-hostnamed to communicate with dhcp via dbus. - systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments. - Add userdom_destroy_unpriv_user_shared_mem() interface. - Label /var/run/systemd/shutdown directory as systemd_logind_var_run_t to allow systemd-logind to access it if shutdown is invoked. - Access needed by systemd-machine to manage docker containers - Allow systemd-logind to read /run/utmp when shutdown is invoked. --- diff --git a/docker-selinux.tgz b/docker-selinux.tgz index 4bda657..b24750c 100644 Binary files a/docker-selinux.tgz and b/docker-selinux.tgz differ diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index d896c23..f0068de 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -6145,7 +6145,7 @@ index 3f6e168..340e49f 100644 ') diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc -index b31c054..d500876 100644 +index b31c054..8722f6d 100644 --- a/policy/modules/kernel/devices.fc +++ b/policy/modules/kernel/devices.fc @@ -15,15 +15,18 @@ @@ -6190,15 +6190,17 @@ index b31c054..d500876 100644 /dev/mergemem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) /dev/mga_vid.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/mice -c gen_context(system_u:object_r:mouse_device_t,s0) -@@ -72,6 +79,7 @@ +@@ -72,7 +79,9 @@ /dev/mixer.* -c gen_context(system_u:object_r:sound_device_t,s0) /dev/mmetfgrab -c gen_context(system_u:object_r:scanner_device_t,s0) /dev/modem -c gen_context(system_u:object_r:modem_device_t,s0) +/dev/monwriter -c gen_context(system_u:object_r:monitor_device_t,s0) /dev/mpu401.* -c gen_context(system_u:object_r:sound_device_t,s0) ++/dev/mpt[0-9]*ctl -c gen_context(system_u:object_r:mptctl_device_t,s0) /dev/msr.* -c gen_context(system_u:object_r:cpu_device_t,s0) /dev/net/vhost -c gen_context(system_u:object_r:vhost_device_t,s0) -@@ -80,6 +88,8 @@ + /dev/network_latency -c gen_context(system_u:object_r:netcontrol_device_t,s0) +@@ -80,6 +89,8 @@ /dev/noz.* -c gen_context(system_u:object_r:modem_device_t,s0) /dev/null -c gen_context(system_u:object_r:null_device_t,s0) /dev/nvidia.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) @@ -6207,7 +6209,7 @@ index b31c054..d500876 100644 /dev/nvram -c gen_context(system_u:object_r:nvram_device_t,mls_systemhigh) /dev/oldmem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) /dev/opengl -c gen_context(system_u:object_r:xserver_misc_device_t,s0) -@@ -90,6 +100,7 @@ +@@ -90,6 +101,7 @@ /dev/pmu -c gen_context(system_u:object_r:power_device_t,s0) /dev/port -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) /dev/pps.* -c gen_context(system_u:object_r:clock_device_t,s0) @@ -6215,7 +6217,7 @@ index b31c054..d500876 100644 /dev/(misc/)?psaux -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/rmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) /dev/radeon -c gen_context(system_u:object_r:dri_device_t,s0) -@@ -106,6 +117,7 @@ +@@ -106,6 +118,7 @@ /dev/snapshot -c gen_context(system_u:object_r:apm_bios_t,s0) /dev/sndstat -c gen_context(system_u:object_r:sound_device_t,s0) /dev/sonypi -c gen_context(system_u:object_r:v4l_device_t,s0) @@ -6223,7 +6225,7 @@ index b31c054..d500876 100644 /dev/tlk[0-3] -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/tpm[0-9]* -c gen_context(system_u:object_r:tpm_device_t,s0) /dev/uinput -c gen_context(system_u:object_r:event_device_t,s0) -@@ -118,6 +130,12 @@ +@@ -118,6 +131,12 @@ ifdef(`distro_suse', ` /dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0) ') @@ -6236,7 +6238,7 @@ index b31c054..d500876 100644 /dev/vhost-net -c gen_context(system_u:object_r:vhost_device_t,s0) /dev/vbi.* -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/vbox.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) -@@ -129,12 +147,14 @@ ifdef(`distro_suse', ` +@@ -129,12 +148,14 @@ ifdef(`distro_suse', ` /dev/vttuner -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/vtx.* -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/watchdog.* -c gen_context(system_u:object_r:watchdog_device_t,s0) @@ -6251,7 +6253,7 @@ index b31c054..d500876 100644 /dev/card.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/cmx.* -c gen_context(system_u:object_r:smartcard_device_t,s0) -@@ -172,6 +192,8 @@ ifdef(`distro_suse', ` +@@ -172,6 +193,8 @@ ifdef(`distro_suse', ` /dev/touchscreen/ucb1x00 -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/touchscreen/mk712 -c gen_context(system_u:object_r:mouse_device_t,s0) @@ -6260,7 +6262,7 @@ index b31c054..d500876 100644 /dev/usb/dc2xx.* -c gen_context(system_u:object_r:scanner_device_t,s0) /dev/usb/lp.* -c gen_context(system_u:object_r:printer_device_t,s0) /dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0) -@@ -198,12 +220,27 @@ ifdef(`distro_debian',` +@@ -198,12 +221,27 @@ ifdef(`distro_debian',` /lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0) /lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0) @@ -6291,7 +6293,7 @@ index b31c054..d500876 100644 +/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0) +/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0) diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if -index 76f285e..68ef8e7 100644 +index 76f285e..b7a4271 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',` @@ -8665,7 +8667,7 @@ index 76f285e..68ef8e7 100644 ## Read and write to the zero device (/dev/zero). ## ## -@@ -4851,3 +5896,966 @@ interface(`dev_unconfined',` +@@ -4851,3 +5896,978 @@ interface(`dev_unconfined',` typeattribute $1 devices_unconfined_type; ') @@ -8878,6 +8880,7 @@ index 76f285e..68ef8e7 100644 + type smartcard_device_t; + type mtrr_device_t; + type ecryptfs_device_t; ++ type mptctl_device_t; +') + + dev_filetrans_printer_named_dev($1) @@ -9147,6 +9150,17 @@ index 76f285e..68ef8e7 100644 + filetrans_pattern($1, device_t, mouse_device_t, chr_file, "mouse8") + filetrans_pattern($1, device_t, mouse_device_t, chr_file, "mouse9") + filetrans_pattern($1, device_t, memory_device_t, chr_file, "kmem") ++ filetrans_pattern($1, device_t, mptctl_device_t, chr_file, "mptctl") ++ filetrans_pattern($1, device_t, mptctl_device_t, chr_file, "mpt0ctl") ++ filetrans_pattern($1, device_t, mptctl_device_t, chr_file, "mpt1ctl") ++ filetrans_pattern($1, device_t, mptctl_device_t, chr_file, "mpt2ctl") ++ filetrans_pattern($1, device_t, mptctl_device_t, chr_file, "mpt3ctl") ++ filetrans_pattern($1, device_t, mptctl_device_t, chr_file, "mpt4ctl") ++ filetrans_pattern($1, device_t, mptctl_device_t, chr_file, "mpt5ctl") ++ filetrans_pattern($1, device_t, mptctl_device_t, chr_file, "mpt6ctl") ++ filetrans_pattern($1, device_t, mptctl_device_t, chr_file, "mpt7ctl") ++ filetrans_pattern($1, device_t, mptctl_device_t, chr_file, "mpt8ctl") ++ filetrans_pattern($1, device_t, mptctl_device_t, chr_file, "mpt9ctl") + filetrans_pattern($1, device_t, kmsg_device_t, chr_file, "kmsg") + filetrans_pattern($1, device_t, qemu_device_t, chr_file, "kqemu") + filetrans_pattern($1, device_t, ksm_device_t, chr_file, "ksm") @@ -9633,7 +9647,7 @@ index 76f285e..68ef8e7 100644 + filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card9") +') diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te -index 0b1a871..f260e6f 100644 +index 0b1a871..db37cad 100644 --- a/policy/modules/kernel/devices.te +++ b/policy/modules/kernel/devices.te @@ -15,11 +15,12 @@ attribute devices_unconfined_type; @@ -9701,7 +9715,7 @@ index 0b1a871..f260e6f 100644 type loop_control_device_t; dev_node(loop_control_device_t) -@@ -150,6 +161,12 @@ type modem_device_t; +@@ -150,12 +161,24 @@ type modem_device_t; dev_node(modem_device_t) # @@ -9714,7 +9728,19 @@ index 0b1a871..f260e6f 100644 # A more general type for mouse devices. # type mouse_device_t; -@@ -183,6 +200,12 @@ type nvram_device_t; + dev_node(mouse_device_t) + + # ++# Type for /dev/mptctl used to check RAID status. ++# ++type mptctl_device_t; ++dev_node(mptctl_device_t) ++ ++# + # Type for /dev/cpu/mtrr and /proc/mtrr + # + type mtrr_device_t; +@@ -183,6 +206,12 @@ type nvram_device_t; dev_node(nvram_device_t) # @@ -9727,7 +9753,7 @@ index 0b1a871..f260e6f 100644 # Type for /dev/pmu # type power_device_t; -@@ -227,6 +250,10 @@ files_mountpoint(sysfs_t) +@@ -227,6 +256,10 @@ files_mountpoint(sysfs_t) fs_type(sysfs_t) genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0) @@ -9738,7 +9764,7 @@ index 0b1a871..f260e6f 100644 # # Type for /dev/tpm # -@@ -266,6 +293,15 @@ dev_node(usbmon_device_t) +@@ -266,6 +299,15 @@ dev_node(usbmon_device_t) type userio_device_t; dev_node(userio_device_t) @@ -9754,7 +9780,7 @@ index 0b1a871..f260e6f 100644 type v4l_device_t; dev_node(v4l_device_t) -@@ -274,6 +310,7 @@ dev_node(v4l_device_t) +@@ -274,6 +316,7 @@ dev_node(v4l_device_t) # type vhost_device_t; dev_node(vhost_device_t) @@ -9762,7 +9788,7 @@ index 0b1a871..f260e6f 100644 # Type for vmware devices. type vmware_device_t; -@@ -319,5 +356,6 @@ files_associate_tmp(device_node) +@@ -319,5 +362,6 @@ files_associate_tmp(device_node) # allow devices_unconfined_type self:capability sys_rawio; @@ -32242,7 +32268,7 @@ index bc0ffc8..37b8ea5 100644 ') +/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0) diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if -index 79a45f6..9769b64 100644 +index 79a45f6..af3877f 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -1,5 +1,21 @@ @@ -32586,20 +32612,37 @@ index 79a45f6..9769b64 100644 ## Connect to init with a unix socket. ## ## -@@ -576,10 +719,66 @@ interface(`init_sigchld',` +@@ -576,12 +719,87 @@ interface(`init_sigchld',` # interface(`init_stream_connect',` gen_require(` -- type init_t; + type init_t, init_var_run_t; - ') - -- allow $1 init_t:unix_stream_socket connectto; ++ ') ++ + files_search_pids($1) + stream_connect_pattern($1, init_var_run_t, init_var_run_t, init_t) + allow $1 init_t:unix_stream_socket getattr; +') + ++######################################## ++## ++## Connect to init with a unix socket. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`init_stream_connectto',` ++ gen_require(` + type init_t; + ') + ++ files_search_pids($1) + allow $1 init_t:unix_stream_socket connectto; + ') + +####################################### +## +## Dontaudit Connect to init with a unix socket. @@ -32652,10 +32695,12 @@ index 79a45f6..9769b64 100644 + ') + + dontaudit $1 init_t:unix_stream_socket { getattr read write ioctl }; - ') - ++') ++ ######################################## -@@ -743,22 +942,24 @@ interface(`init_write_initctl',` + ## + ## Inherit and use file descriptors from init. +@@ -743,22 +961,24 @@ interface(`init_write_initctl',` interface(`init_telinit',` gen_require(` type initctl_t; @@ -32689,7 +32734,7 @@ index 79a45f6..9769b64 100644 ') ######################################## -@@ -787,7 +988,7 @@ interface(`init_rw_initctl',` +@@ -787,7 +1007,7 @@ interface(`init_rw_initctl',` ## ## ## @@ -32698,7 +32743,7 @@ index 79a45f6..9769b64 100644 ## ## # -@@ -830,11 +1031,12 @@ interface(`init_script_file_entry_type',` +@@ -830,11 +1050,12 @@ interface(`init_script_file_entry_type',` # interface(`init_spec_domtrans_script',` gen_require(` @@ -32713,7 +32758,7 @@ index 79a45f6..9769b64 100644 ifdef(`distro_gentoo',` gen_require(` -@@ -845,11 +1047,11 @@ interface(`init_spec_domtrans_script',` +@@ -845,11 +1066,11 @@ interface(`init_spec_domtrans_script',` ') ifdef(`enable_mcs',` @@ -32727,7 +32772,7 @@ index 79a45f6..9769b64 100644 ') ') -@@ -865,19 +1067,41 @@ interface(`init_spec_domtrans_script',` +@@ -865,19 +1086,41 @@ interface(`init_spec_domtrans_script',` # interface(`init_domtrans_script',` gen_require(` @@ -32773,7 +32818,7 @@ index 79a45f6..9769b64 100644 ') ######################################## -@@ -933,9 +1157,14 @@ interface(`init_script_file_domtrans',` +@@ -933,9 +1176,14 @@ interface(`init_script_file_domtrans',` interface(`init_labeled_script_domtrans',` gen_require(` type initrc_t; @@ -32788,161 +32833,267 @@ index 79a45f6..9769b64 100644 files_search_etc($1) ') -@@ -1012,6 +1241,62 @@ interface(`init_read_state',` +@@ -1012,26 +1260,27 @@ interface(`init_read_state',` ######################################## ## +-## Ptrace init +## Dontaudit read the process state (/proc/pid) of init. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## + ## Domain allowed access. + ## + ## +-## + # +-interface(`init_ptrace',` +interface(`init_dontaudit_read_state',` -+ gen_require(` -+ type init_t; -+ ') -+ + gen_require(` + type init_t; + ') + +- allow $1 init_t:process ptrace; + dontaudit $1 init_t:dir search_dir_perms; + dontaudit $1 init_t:file read_file_perms; + dontaudit $1 init_t:lnk_file read_lnk_file_perms; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Write an init script unnamed pipe. +## Read the process keyring of init. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -1039,17 +1288,17 @@ interface(`init_ptrace',` + ## + ## + # +-interface(`init_write_script_pipes',` +interface(`init_read_key',` -+ gen_require(` + gen_require(` +- type initrc_t; + type init_t; -+ ') -+ + ') + +- allow $1 initrc_t:fifo_file write; + allow $1 init_t:key read; -+') -+ -+######################################## -+## + ') + + ######################################## + ## +-## Get the attribute of init script entrypoint files. +## Write the process keyring of init. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -1057,37 +1306,38 @@ interface(`init_write_script_pipes',` + ## + ## + # +-interface(`init_getattr_script_files',` +interface(`init_write_key',` -+ gen_require(` + gen_require(` +- type initrc_exec_t; + type init_t; -+ ') -+ + ') + +- files_list_etc($1) +- allow $1 initrc_exec_t:file getattr; + allow $1 init_t:key read; -+') -+ -+######################################## -+## - ## Ptrace init + ') + + ######################################## + ## +-## Read init scripts. ++## Ptrace init ## ## -@@ -1026,7 +1311,9 @@ interface(`init_ptrace',` - type init_t; + ## + ## Domain allowed access. + ## + ## ++## + # +-interface(`init_read_script_files',` ++interface(`init_ptrace',` + gen_require(` +- type initrc_exec_t; ++ type init_t; ') -- allow $1 init_t:process ptrace; +- files_search_etc($1) +- allow $1 initrc_exec_t:file read_file_perms; + tunable_policy(`deny_ptrace',`',` + allow $1 init_t:process ptrace; + ') ') ######################################## -@@ -1125,7 +1412,8 @@ interface(`init_getattr_all_script_files',` + ## +-## Execute init scripts in the caller domain. ++## Write an init script unnamed pipe. + ## + ## + ## +@@ -1095,18 +1345,17 @@ interface(`init_read_script_files',` + ## + ## + # +-interface(`init_exec_script_files',` ++interface(`init_write_script_pipes',` + gen_require(` +- type initrc_exec_t; ++ type initrc_t; + ') + +- files_list_etc($1) +- can_exec($1, initrc_exec_t) ++ allow $1 initrc_t:fifo_file write; + ') ######################################## ## --## Read all init script files. -+## Allow the specified domain to modify the systemd configuration of -+## all init scripts. +-## Get the attribute of all init script entrypoint files. ++## Get the attribute of init script entrypoint files. ## ## ## -@@ -1133,26 +1421,62 @@ interface(`init_getattr_all_script_files',` +@@ -1114,18 +1363,18 @@ interface(`init_exec_script_files',` ## ## # --interface(`init_read_all_script_files',` -+interface(`init_config_all_script_files',` +-interface(`init_getattr_all_script_files',` ++interface(`init_getattr_script_files',` gen_require(` - attribute init_script_file_type; +- attribute init_script_file_type; ++ type initrc_exec_t; ') -- files_search_etc($1) -- allow $1 init_script_file_type:file read_file_perms; -+ allow $1 init_script_file_type:service all_service_perms; + files_list_etc($1) +- allow $1 init_script_file_type:file getattr; ++ allow $1 initrc_exec_t:file getattr; ') --####################################### -+######################################## + ######################################## ## --## Dontaudit read all init script files. -+## Read all init script files. +-## Read all init script files. ++## Read init scripts. ## ## ## --## Domain to not audit. -+## Domain allowed access. +@@ -1133,7 +1382,83 @@ interface(`init_getattr_all_script_files',` ## ## # --interface(`init_dontaudit_read_all_script_files',` -+interface(`init_read_all_script_files',` +-interface(`init_read_all_script_files',` ++interface(`init_read_script_files',` + gen_require(` -+ attribute init_script_file_type; ++ type initrc_exec_t; + ') + + files_search_etc($1) -+ allow $1 init_script_file_type:file read_file_perms; ++ allow $1 initrc_exec_t:file read_file_perms; +') + -+####################################### ++######################################## +## -+## Dontaudit getattr all init script files. ++## Execute init scripts in the caller domain. +## +## +## -+## Domain to not audit. ++## Domain allowed access. +## +## +# -+interface(`init_dontaudit_getattr_all_script_files',` ++interface(`init_exec_script_files',` ++ gen_require(` ++ type initrc_exec_t; ++ ') ++ ++ files_list_etc($1) ++ can_exec($1, initrc_exec_t) ++') ++ ++######################################## ++## ++## Get the attribute of all init script entrypoint files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`init_getattr_all_script_files',` + gen_require(` + attribute init_script_file_type; + ') + -+ dontaudit $1 init_script_file_type:file getattr; ++ files_list_etc($1) ++ allow $1 init_script_file_type:file getattr; +') + -+####################################### ++######################################## +## -+## Dontaudit read all init script files. ++## Allow the specified domain to modify the systemd configuration of ++## all init scripts. +## +## +## -+## Domain to not audit. ++## Domain allowed access. +## +## +# -+interface(`init_dontaudit_read_all_script_files',` ++interface(`init_config_all_script_files',` ++ gen_require(` ++ attribute init_script_file_type; ++ ') ++ ++ allow $1 init_script_file_type:service all_service_perms; ++') ++ ++######################################## ++## ++## Read all init script files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`init_read_all_script_files',` gen_require(` attribute init_script_file_type; ') -@@ -1195,12 +1519,7 @@ interface(`init_read_script_state',` +@@ -1144,6 +1469,24 @@ interface(`init_read_all_script_files',` + + ####################################### + ## ++## Dontaudit getattr all init script files. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`init_dontaudit_getattr_all_script_files',` ++ gen_require(` ++ attribute init_script_file_type; ++ ') ++ ++ dontaudit $1 init_script_file_type:file getattr; ++') ++ ++####################################### ++## + ## Dontaudit read all init script files. + ## + ## +@@ -1195,12 +1538,7 @@ interface(`init_read_script_state',` ') kernel_search_proc($1) @@ -32956,7 +33107,7 @@ index 79a45f6..9769b64 100644 ') ######################################## -@@ -1314,6 +1633,24 @@ interface(`init_signal_script',` +@@ -1314,6 +1652,24 @@ interface(`init_signal_script',` ######################################## ## @@ -32981,7 +33132,7 @@ index 79a45f6..9769b64 100644 ## Send null signals to init scripts. ## ## -@@ -1440,6 +1777,27 @@ interface(`init_dbus_send_script',` +@@ -1440,6 +1796,27 @@ interface(`init_dbus_send_script',` ######################################## ## ## Send and receive messages from @@ -33009,7 +33160,7 @@ index 79a45f6..9769b64 100644 ## init scripts over dbus. ## ## -@@ -1547,6 +1905,25 @@ interface(`init_getattr_script_status_files',` +@@ -1547,6 +1924,25 @@ interface(`init_getattr_script_status_files',` ######################################## ## @@ -33035,7 +33186,7 @@ index 79a45f6..9769b64 100644 ## Do not audit attempts to read init script ## status files. ## -@@ -1605,6 +1982,24 @@ interface(`init_rw_script_tmp_files',` +@@ -1605,6 +2001,24 @@ interface(`init_rw_script_tmp_files',` ######################################## ## @@ -33060,7 +33211,7 @@ index 79a45f6..9769b64 100644 ## Create files in a init script ## temporary data directory. ## -@@ -1677,6 +2072,43 @@ interface(`init_read_utmp',` +@@ -1677,6 +2091,43 @@ interface(`init_read_utmp',` ######################################## ## @@ -33104,7 +33255,7 @@ index 79a45f6..9769b64 100644 ## Do not audit attempts to write utmp. ## ## -@@ -1765,7 +2197,7 @@ interface(`init_dontaudit_rw_utmp',` +@@ -1765,7 +2216,7 @@ interface(`init_dontaudit_rw_utmp',` type initrc_var_run_t; ') @@ -33113,7 +33264,7 @@ index 79a45f6..9769b64 100644 ') ######################################## -@@ -1806,6 +2238,133 @@ interface(`init_pid_filetrans_utmp',` +@@ -1806,6 +2257,133 @@ interface(`init_pid_filetrans_utmp',` files_pid_filetrans($1, initrc_var_run_t, file, "utmp") ') @@ -33247,7 +33398,7 @@ index 79a45f6..9769b64 100644 ######################################## ## ## Allow the specified domain to connect to daemon with a tcp socket -@@ -1840,3 +2399,492 @@ interface(`init_udp_recvfrom_all_daemons',` +@@ -1840,3 +2418,492 @@ interface(`init_udp_recvfrom_all_daemons',` ') corenet_udp_recvfrom_labeled($1, daemon) ') @@ -42888,7 +43039,7 @@ index 2cea692..57c9025 100644 + files_pid_filetrans($1, ifconfig_var_run_t, dir, "netns") +') diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te -index a392fc4..30cf590 100644 +index a392fc4..78fa512 100644 --- a/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te @@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.15.4) @@ -43093,20 +43244,25 @@ index a392fc4..30cf590 100644 ') optional_policy(` -@@ -221,7 +257,11 @@ optional_policy(` +@@ -221,7 +257,16 @@ optional_policy(` optional_policy(` seutil_sigchld_newrole(dhcpc_t) - seutil_dontaudit_search_config(dhcpc_t) + seutil_domtrans_setfiles(dhcpc_t) +') ++ ++optional_policy(` ++ systemd_dbus_chat_hostnamed(dhcpc_t) ++') ++ +optional_policy(` + systemd_passwd_agent_domtrans(dhcpc_t) + systemd_signal_passwd_agent(dhcpc_t) ') optional_policy(` -@@ -233,6 +273,10 @@ optional_policy(` +@@ -233,6 +278,10 @@ optional_policy(` ') optional_policy(` @@ -43117,7 +43273,7 @@ index a392fc4..30cf590 100644 vmware_append_log(dhcpc_t) ') -@@ -264,12 +308,25 @@ allow ifconfig_t self:msgq create_msgq_perms; +@@ -264,12 +313,25 @@ allow ifconfig_t self:msgq create_msgq_perms; allow ifconfig_t self:msg { send receive }; # Create UDP sockets, necessary when called from dhcpc allow ifconfig_t self:udp_socket create_socket_perms; @@ -43143,7 +43299,7 @@ index a392fc4..30cf590 100644 kernel_use_fds(ifconfig_t) kernel_read_system_state(ifconfig_t) kernel_read_network_state(ifconfig_t) -@@ -279,14 +336,32 @@ kernel_rw_net_sysctls(ifconfig_t) +@@ -279,14 +341,32 @@ kernel_rw_net_sysctls(ifconfig_t) corenet_rw_tun_tap_dev(ifconfig_t) @@ -43176,7 +43332,7 @@ index a392fc4..30cf590 100644 fs_getattr_xattr_fs(ifconfig_t) fs_search_auto_mountpoints(ifconfig_t) -@@ -299,33 +374,51 @@ term_dontaudit_use_all_ptys(ifconfig_t) +@@ -299,33 +379,51 @@ term_dontaudit_use_all_ptys(ifconfig_t) term_dontaudit_use_ptmx(ifconfig_t) term_dontaudit_use_generic_ptys(ifconfig_t) @@ -43234,7 +43390,7 @@ index a392fc4..30cf590 100644 optional_policy(` dev_dontaudit_rw_cardmgr(ifconfig_t) ') -@@ -336,7 +429,11 @@ ifdef(`hide_broken_symptoms',` +@@ -336,7 +434,11 @@ ifdef(`hide_broken_symptoms',` ') optional_policy(` @@ -43247,7 +43403,7 @@ index a392fc4..30cf590 100644 ') optional_policy(` -@@ -350,7 +447,16 @@ optional_policy(` +@@ -350,7 +452,16 @@ optional_policy(` ') optional_policy(` @@ -43265,7 +43421,7 @@ index a392fc4..30cf590 100644 ') optional_policy(` -@@ -371,3 +477,13 @@ optional_policy(` +@@ -371,3 +482,13 @@ optional_policy(` xen_append_log(ifconfig_t) xen_dontaudit_rw_unix_stream_sockets(ifconfig_t) ') @@ -43281,10 +43437,10 @@ index a392fc4..30cf590 100644 +') diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc new file mode 100644 -index 0000000..66b8608 +index 0000000..85ef000 --- /dev/null +++ b/policy/modules/system/systemd.fc -@@ -0,0 +1,55 @@ +@@ -0,0 +1,56 @@ +HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_home_t,s0) +/root/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_home_t,s0) + @@ -43333,6 +43489,7 @@ index 0000000..66b8608 +/var/run/nologin gen_context(system_u:object_r:systemd_logind_var_run_t,s0) +/var/run/systemd/seats(/.*)? gen_context(system_u:object_r:systemd_logind_var_run_t,s0) +/var/run/systemd/sessions(/.*)? gen_context(system_u:object_r:systemd_logind_sessions_t,s0) ++/var/run/systemd/shutdown(/.*)? gen_context(system_u:object_r:systemd_logind_var_run_t,s0) +/var/run/systemd/users(/.*)? gen_context(system_u:object_r:systemd_logind_var_run_t,s0) +/var/run/systemd/inhibit(/.*)? gen_context(system_u:object_r:systemd_logind_inhibit_var_run_t,s0) +/var/run/systemd/ask-password-block(/.*)? gen_context(system_u:object_r:systemd_passwd_var_run_t,s0) @@ -43342,10 +43499,10 @@ index 0000000..66b8608 +/var/run/initramfs(/.*)? <> diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if new file mode 100644 -index 0000000..697417b +index 0000000..c253b33 --- /dev/null +++ b/policy/modules/system/systemd.if -@@ -0,0 +1,1639 @@ +@@ -0,0 +1,1640 @@ +## SELinux policy for systemd components + +###################################### @@ -44463,6 +44620,7 @@ index 0000000..697417b + ') + + files_pid_filetrans($1, systemd_logind_var_run_t, file, "nologin") ++ files_pid_filetrans($1, systemd_logind_var_run_t, file, "shutdown") + init_named_pid_filetrans($1, systemd_passwd_var_run_t, dir, "ask-password-block") + init_named_pid_filetrans($1, systemd_passwd_var_run_t, dir, "ask-password") + files_etc_filetrans($1, hostname_etc_t, file, "hostname" ) @@ -44987,10 +45145,10 @@ index 0000000..697417b +') diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te new file mode 100644 -index 0000000..dde1f34 +index 0000000..9afb637 --- /dev/null +++ b/policy/modules/system/systemd.te -@@ -0,0 +1,780 @@ +@@ -0,0 +1,788 @@ +policy_module(systemd, 1.0.0) + +####################################### @@ -45198,6 +45356,7 @@ index 0000000..dde1f34 +init_dbus_chat(systemd_logind_t) +init_dbus_chat_script(systemd_logind_t) +init_read_script_state(systemd_logind_t) ++init_read_utmp(systemd_logind_t) +init_rw_stream_sockets(systemd_logind_t) + +logging_send_syslog_msg(systemd_logind_t) @@ -45205,6 +45364,7 @@ index 0000000..dde1f34 +udev_read_db(systemd_logind_t) +udev_manage_rules_files(systemd_logind_t) + ++userdom_destroy_unpriv_user_shared_mem(systemd_logind_t) +userdom_read_all_users_state(systemd_logind_t) +userdom_use_user_ttys(systemd_logind_t) +userdom_manage_tmp_role(system_r, systemd_logind_t) @@ -45291,6 +45451,11 @@ index 0000000..dde1f34 +optional_policy(` + virt_dbus_chat(systemd_machined_t) + virt_sandbox_read_state(systemd_machined_t) ++ virt_signal_sandbox(systemd_machined_t) ++ virt_stream_connect_sandbox(systemd_machined_t) ++ virt_rw_svirt_dev(systemd_machined_t) ++ virt_getattr_sandbox_filesystem(systemd_machined_t) ++ virt_read_sandbox_files(systemd_machined_t) +') + +####################################### @@ -45739,6 +45904,7 @@ index 0000000..dde1f34 +# Common rules for systemd domains +# +allow systemd_domain self:process { setfscreate signal_perms }; ++allow systemd_domain self:unix_dgram_socket { create_socket_perms sendto }; +dontaudit systemd_domain self:capability net_admin; + +dev_read_urand(systemd_domain) @@ -47184,7 +47350,7 @@ index db75976..c54480a 100644 +/var/tmp/hsperfdata_root gen_context(system_u:object_r:user_tmp_t,s0) + diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if -index 9dc60c6..14be41c 100644 +index 9dc60c6..c0265be 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -30,9 +30,11 @@ template(`userdom_base_user_template',` @@ -50019,123 +50185,123 @@ index 9dc60c6..14be41c 100644 ') ######################################## -@@ -2955,69 +3955,68 @@ interface(`userdom_spec_domtrans_unpriv_users',` +@@ -2955,6 +3955,42 @@ interface(`userdom_spec_domtrans_unpriv_users',` allow unpriv_userdomain $1:process sigchld; ') --######################################## +##################################### - ## --## Execute an Xserver session in all unprivileged user domains. This --## is an explicit transition, requiring the --## caller to use setexeccon(). ++## +## Allow domain dyntrans to unpriv userdomain. - ## - ## --## --## Domain allowed to transition. --## ++## ++## +## +## Domain allowed access. +## - ## - # --interface(`userdom_xsession_spec_domtrans_unpriv_users',` -- gen_require(` -- attribute unpriv_userdomain; -- ') ++## ++# +interface(`userdom_dyntransition_unpriv_users',` + gen_require(` + attribute unpriv_userdomain; + ') - -- xserver_xsession_spec_domtrans($1, unpriv_userdomain) -- allow unpriv_userdomain $1:fd use; -- allow unpriv_userdomain $1:fifo_file rw_file_perms; -- allow unpriv_userdomain $1:process sigchld; ++ + allow $1 unpriv_userdomain:process dyntransition; ++') ++ ++#################################### ++## ++## Allow domain dyntrans to admin userdomain. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`userdom_dyntransition_admin_users',` ++ gen_require(` ++ attribute admindomain; ++ ') ++ ++ allow $1 admindomain:process dyntransition; ++') ++ + ######################################## + ## + ## Execute an Xserver session in all unprivileged user domains. This +@@ -2978,24 +4014,6 @@ interface(`userdom_xsession_spec_domtrans_unpriv_users',` + allow unpriv_userdomain $1:process sigchld; ') -####################################### -+#################################### - ## +-## -## Read and write unpriviledged user SysV sempaphores. -+## Allow domain dyntrans to admin userdomain. - ## - ## +-## +-## -## -## Domain allowed access. -## -+## -+## Domain allowed access. -+## - ## - # +-## +-# -interface(`userdom_rw_unpriv_user_semaphores',` - gen_require(` - attribute unpriv_userdomain; - ') -+interface(`userdom_dyntransition_admin_users',` -+ gen_require(` -+ attribute admindomain; -+ ') - +- - allow $1 unpriv_userdomain:sem rw_sem_perms; -+ allow $1 admindomain:process dyntransition; +-') +- + ######################################## + ## + ## Manage unpriviledged user SysV sempaphores. +@@ -3014,9 +4032,9 @@ interface(`userdom_manage_unpriv_user_semaphores',` + allow $1 unpriv_userdomain:sem create_sem_perms; ') - ######################################## +-####################################### ++######################################## ## --## Manage unpriviledged user SysV sempaphores. -+## Execute an Xserver session in all unprivileged user domains. This -+## is an explicit transition, requiring the -+## caller to use setexeccon(). +-## Read and write unpriviledged user SysV shared ++## Manage unpriviledged user SysV shared + ## memory segments. ## ## - ## --## Domain allowed access. -+## Domain allowed to transition. +@@ -3025,17 +4043,17 @@ interface(`userdom_manage_unpriv_user_semaphores',` ## ## # --interface(`userdom_manage_unpriv_user_semaphores',` -+interface(`userdom_xsession_spec_domtrans_unpriv_users',` +-interface(`userdom_rw_unpriv_user_shared_mem',` ++interface(`userdom_manage_unpriv_user_shared_mem',` gen_require(` attribute unpriv_userdomain; ') -- allow $1 unpriv_userdomain:sem create_sem_perms; -+ xserver_xsession_spec_domtrans($1, unpriv_userdomain) -+ allow unpriv_userdomain $1:fd use; -+ allow unpriv_userdomain $1:fifo_file rw_file_perms; -+ allow unpriv_userdomain $1:process sigchld; +- allow $1 unpriv_userdomain:shm rw_shm_perms; ++ allow $1 unpriv_userdomain:shm create_shm_perms; ') --####################################### -+######################################## + ######################################## ## --## Read and write unpriviledged user SysV shared --## memory segments. -+## Manage unpriviledged user SysV sempaphores. +-## Manage unpriviledged user SysV shared ++## Destroy unpriviledged user SysV shared + ## memory segments. ## ## - ## -@@ -3025,12 +4024,12 @@ interface(`userdom_manage_unpriv_user_semaphores',` +@@ -3044,12 +4062,12 @@ interface(`userdom_rw_unpriv_user_shared_mem',` ## ## # --interface(`userdom_rw_unpriv_user_shared_mem',` -+interface(`userdom_manage_unpriv_user_semaphores',` +-interface(`userdom_manage_unpriv_user_shared_mem',` ++interface(`userdom_destroy_unpriv_user_shared_mem',` gen_require(` attribute unpriv_userdomain; ') -- allow $1 unpriv_userdomain:shm rw_shm_perms; -+ allow $1 unpriv_userdomain:sem create_sem_perms; +- allow $1 unpriv_userdomain:shm create_shm_perms; ++ allow $1 unpriv_userdomain:shm destroy; ') ######################################## -@@ -3094,7 +4093,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',` +@@ -3094,7 +4112,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',` domain_entry_file_spec_domtrans($1, unpriv_userdomain) allow unpriv_userdomain $1:fd use; @@ -50144,7 +50310,7 @@ index 9dc60c6..14be41c 100644 allow unpriv_userdomain $1:process sigchld; ') -@@ -3110,29 +4109,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',` +@@ -3110,29 +4128,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',` # interface(`userdom_search_user_home_content',` gen_require(` @@ -50178,7 +50344,7 @@ index 9dc60c6..14be41c 100644 ') ######################################## -@@ -3214,7 +4197,25 @@ interface(`userdom_dontaudit_use_user_ptys',` +@@ -3214,7 +4216,25 @@ interface(`userdom_dontaudit_use_user_ptys',` type user_devpts_t; ') @@ -50205,7 +50371,7 @@ index 9dc60c6..14be41c 100644 ') ######################################## -@@ -3269,12 +4270,13 @@ interface(`userdom_write_user_tmp_files',` +@@ -3269,12 +4289,13 @@ interface(`userdom_write_user_tmp_files',` type user_tmp_t; ') @@ -50221,7 +50387,7 @@ index 9dc60c6..14be41c 100644 ## ## ## -@@ -3282,54 +4284,130 @@ interface(`userdom_write_user_tmp_files',` +@@ -3282,54 +4303,56 @@ interface(`userdom_write_user_tmp_files',` ## ## # @@ -50290,18 +50456,20 @@ index 9dc60c6..14be41c 100644 -## Inherit the file descriptors from all user domains +## Allow domain to read/write inherited users +## fifo files. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# + ## + ## + ## +@@ -3337,12 +4360,86 @@ interface(`userdom_getattr_all_users',` + ## + ## + # +-interface(`userdom_use_all_users_fds',` +interface(`userdom_rw_inherited_user_pipes',` -+ gen_require(` -+ attribute userdomain; -+ ') -+ + gen_require(` + attribute userdomain; + ') + +- allow $1 userdomain:fd use; + allow $1 userdomain:fifo_file rw_inherited_fifo_file_perms; +') + @@ -50364,10 +50532,23 @@ index 9dc60c6..14be41c 100644 +######################################## +## +## Inherit the file descriptors from all user domains - ## - ## - ## -@@ -3382,6 +4460,42 @@ interface(`userdom_signal_all_users',` ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`userdom_use_all_users_fds',` ++ gen_require(` ++ attribute userdomain; ++ ') ++ ++ allow $1 userdomain:fd use; + ') + + ######################################## +@@ -3382,6 +4479,42 @@ interface(`userdom_signal_all_users',` allow $1 userdomain:process signal; ') @@ -50410,7 +50591,7 @@ index 9dc60c6..14be41c 100644 ######################################## ## ## Send a SIGCHLD signal to all user domains. -@@ -3402,6 +4516,60 @@ interface(`userdom_sigchld_all_users',` +@@ -3402,6 +4535,60 @@ interface(`userdom_sigchld_all_users',` ######################################## ## @@ -50471,7 +50652,7 @@ index 9dc60c6..14be41c 100644 ## Create keys for all user domains. ## ## -@@ -3435,4 +4603,1727 @@ interface(`userdom_dbus_send_all_users',` +@@ -3435,4 +4622,1727 @@ interface(`userdom_dbus_send_all_users',` ') allow $1 userdomain:dbus send_msg; diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index 5c5030c..dc370d4 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -589,7 +589,7 @@ index 058d908..ee0c559 100644 +') + diff --git a/abrt.te b/abrt.te -index eb50f07..7ed1072 100644 +index eb50f07..5ad038c 100644 --- a/abrt.te +++ b/abrt.te @@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1) @@ -608,7 +608,7 @@ index eb50f07..7ed1072 100644 ## gen_tunable(abrt_anon_write, false) -@@ -37,87 +36,98 @@ attribute abrt_domain; +@@ -37,87 +36,99 @@ attribute abrt_domain; attribute_role abrt_helper_roles; roleattribute system_r abrt_helper_roles; @@ -647,6 +647,7 @@ index eb50f07..7ed1072 100644 -type abrt_dump_oops_exec_t; +abrt_basic_types_template(abrt_dump_oops) init_system_domain(abrt_dump_oops_t, abrt_dump_oops_exec_t) ++domain_obj_id_change_exemption(abrt_dump_oops_t) -type abrt_handle_event_t, abrt_domain; -type abrt_handle_event_exec_t; @@ -737,7 +738,7 @@ index eb50f07..7ed1072 100644 manage_files_pattern(abrt_t, abrt_var_log_t, abrt_var_log_t) logging_log_filetrans(abrt_t, abrt_var_log_t, file) -@@ -125,48 +135,59 @@ manage_dirs_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t) +@@ -125,48 +136,59 @@ manage_dirs_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t) manage_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t) manage_lnk_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t) files_tmp_filetrans(abrt_t, abrt_tmp_t, { file dir }) @@ -804,7 +805,7 @@ index eb50f07..7ed1072 100644 domain_getattr_all_domains(abrt_t) domain_read_all_domains_state(abrt_t) -@@ -176,29 +197,43 @@ files_getattr_all_files(abrt_t) +@@ -176,29 +198,43 @@ files_getattr_all_files(abrt_t) files_read_config_files(abrt_t) files_read_etc_runtime_files(abrt_t) files_read_var_symlinks(abrt_t) @@ -851,7 +852,7 @@ index eb50f07..7ed1072 100644 tunable_policy(`abrt_anon_write',` miscfiles_manage_public_files(abrt_t) -@@ -206,15 +241,11 @@ tunable_policy(`abrt_anon_write',` +@@ -206,15 +242,11 @@ tunable_policy(`abrt_anon_write',` optional_policy(` apache_list_modules(abrt_t) @@ -868,7 +869,7 @@ index eb50f07..7ed1072 100644 ') optional_policy(` -@@ -222,6 +253,32 @@ optional_policy(` +@@ -222,6 +254,32 @@ optional_policy(` ') optional_policy(` @@ -901,7 +902,7 @@ index eb50f07..7ed1072 100644 policykit_domtrans_auth(abrt_t) policykit_read_lib(abrt_t) policykit_read_reload(abrt_t) -@@ -234,6 +291,11 @@ optional_policy(` +@@ -234,6 +292,11 @@ optional_policy(` ') optional_policy(` @@ -913,7 +914,7 @@ index eb50f07..7ed1072 100644 rpm_exec(abrt_t) rpm_dontaudit_manage_db(abrt_t) rpm_manage_cache(abrt_t) -@@ -243,6 +305,7 @@ optional_policy(` +@@ -243,6 +306,7 @@ optional_policy(` rpm_signull(abrt_t) ') @@ -921,7 +922,7 @@ index eb50f07..7ed1072 100644 optional_policy(` sendmail_domtrans(abrt_t) ') -@@ -253,9 +316,21 @@ optional_policy(` +@@ -253,9 +317,21 @@ optional_policy(` sosreport_delete_tmp_files(abrt_t) ') @@ -944,7 +945,7 @@ index eb50f07..7ed1072 100644 # allow abrt_handle_event_t self:fifo_file rw_fifo_file_perms; -@@ -266,9 +341,13 @@ tunable_policy(`abrt_handle_event',` +@@ -266,9 +342,13 @@ tunable_policy(`abrt_handle_event',` can_exec(abrt_t, abrt_handle_event_exec_t) ') @@ -959,7 +960,7 @@ index eb50f07..7ed1072 100644 # allow abrt_helper_t self:capability { chown setgid sys_nice }; -@@ -281,6 +360,7 @@ manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t) +@@ -281,6 +361,7 @@ manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t) manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t) manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t) files_var_filetrans(abrt_helper_t, abrt_var_cache_t, { file dir }) @@ -967,7 +968,7 @@ index eb50f07..7ed1072 100644 read_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t) read_lnk_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t) -@@ -289,15 +369,20 @@ corecmd_read_all_executables(abrt_helper_t) +@@ -289,15 +370,20 @@ corecmd_read_all_executables(abrt_helper_t) domain_read_all_domains_state(abrt_helper_t) @@ -988,7 +989,7 @@ index eb50f07..7ed1072 100644 userdom_dontaudit_read_user_home_content_files(abrt_helper_t) userdom_dontaudit_read_user_tmp_files(abrt_helper_t) dev_dontaudit_read_all_blk_files(abrt_helper_t) -@@ -305,11 +390,25 @@ ifdef(`hide_broken_symptoms',` +@@ -305,11 +391,25 @@ ifdef(`hide_broken_symptoms',` dev_dontaudit_write_all_chr_files(abrt_helper_t) dev_dontaudit_write_all_blk_files(abrt_helper_t) fs_dontaudit_rw_anon_inodefs_files(abrt_helper_t) @@ -1015,7 +1016,7 @@ index eb50f07..7ed1072 100644 # allow abrt_retrace_coredump_t self:fifo_file rw_fifo_file_perms; -@@ -327,10 +426,12 @@ corecmd_exec_shell(abrt_retrace_coredump_t) +@@ -327,10 +427,12 @@ corecmd_exec_shell(abrt_retrace_coredump_t) dev_read_urand(abrt_retrace_coredump_t) @@ -1029,7 +1030,7 @@ index eb50f07..7ed1072 100644 optional_policy(` rpm_exec(abrt_retrace_coredump_t) rpm_dontaudit_manage_db(abrt_retrace_coredump_t) -@@ -343,10 +444,11 @@ optional_policy(` +@@ -343,10 +445,11 @@ optional_policy(` ####################################### # @@ -1043,7 +1044,7 @@ index eb50f07..7ed1072 100644 allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms; domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t) -@@ -365,38 +467,70 @@ corecmd_exec_shell(abrt_retrace_worker_t) +@@ -365,38 +468,71 @@ corecmd_exec_shell(abrt_retrace_worker_t) dev_read_urand(abrt_retrace_worker_t) @@ -1065,7 +1066,7 @@ index eb50f07..7ed1072 100644 # -allow abrt_dump_oops_t self:capability dac_override; -+allow abrt_dump_oops_t self:capability { kill net_admin sys_ptrace ipc_lock fowner chown fsetid dac_override }; ++allow abrt_dump_oops_t self:capability { kill net_admin sys_ptrace ipc_lock fowner chown fsetid dac_override setuid setgid }; +allow abrt_dump_oops_t self:process setfscreate; allow abrt_dump_oops_t self:fifo_file rw_fifo_file_perms; -allow abrt_dump_oops_t self:unix_stream_socket { accept listen }; @@ -1100,6 +1101,7 @@ index eb50f07..7ed1072 100644 +domain_signull_all_domains(abrt_dump_oops_t) +domain_ptrace_all_domains(abrt_dump_oops_t) +domain_read_all_domains_state(abrt_dump_oops_t) ++domain_getattr_all_domains(abrt_dump_oops_t) +files_manage_non_security_dirs(abrt_dump_oops_t) +files_manage_non_security_files(abrt_dump_oops_t) @@ -1118,7 +1120,7 @@ index eb50f07..7ed1072 100644 ####################################### # -@@ -404,25 +538,60 @@ logging_read_generic_logs(abrt_dump_oops_t) +@@ -404,25 +540,60 @@ logging_read_generic_logs(abrt_dump_oops_t) # allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms; @@ -1181,7 +1183,7 @@ index eb50f07..7ed1072 100644 ') ####################################### -@@ -430,10 +599,7 @@ tunable_policy(`abrt_upload_watch_anon_write',` +@@ -430,10 +601,7 @@ tunable_policy(`abrt_upload_watch_anon_write',` # Global local policy # @@ -3164,10 +3166,10 @@ index 0000000..36251b9 +') diff --git a/antivirus.te b/antivirus.te new file mode 100644 -index 0000000..6183b21 +index 0000000..12349f3 --- /dev/null +++ b/antivirus.te -@@ -0,0 +1,271 @@ +@@ -0,0 +1,272 @@ +policy_module(antivirus, 1.0.0) + +######################################## @@ -3281,6 +3283,7 @@ index 0000000..6183b21 +corecmd_exec_shell(antivirus_domain) + +corenet_all_recvfrom_netlabel(antivirus_t) ++corenet_tcp_bind_all_unreserved_ports(antivirus_t) +corenet_tcp_sendrecv_generic_if(antivirus_t) +corenet_udp_sendrecv_generic_if(antivirus_t) +corenet_tcp_sendrecv_generic_node(antivirus_domain) @@ -14722,10 +14725,10 @@ index 5f306dd..e01156f 100644 ') diff --git a/cockpit.fc b/cockpit.fc new file mode 100644 -index 0000000..bb87537 +index 0000000..9ed6fdc --- /dev/null +++ b/cockpit.fc -@@ -0,0 +1,10 @@ +@@ -0,0 +1,12 @@ +# cockpit stuff + +/usr/lib/systemd/system/cockpit.* -- gen_context(system_u:object_r:cockpit_unit_file_t,s0) @@ -14736,12 +14739,14 @@ index 0000000..bb87537 +/usr/libexec/cockpit-session -- gen_context(system_u:object_r:cockpit_session_exec_t,s0) + +/var/lib/cockpit(/.*)? gen_context(system_u:object_r:cockpit_var_lib_t,s0) ++ ++/var/run/cockpit-ws(/.*)? gen_context(system_u:object_r:cockpit_var_run_t,s0) diff --git a/cockpit.if b/cockpit.if new file mode 100644 -index 0000000..eb2739a +index 0000000..d5920c0 --- /dev/null +++ b/cockpit.if -@@ -0,0 +1,184 @@ +@@ -0,0 +1,188 @@ +## policy for cockpit + +######################################## @@ -14901,6 +14906,7 @@ index 0000000..eb2739a + type cockpit_ws_t; + type cockpit_session_t; + type cockpit_var_lib_t; ++ type cockpit_var_run_t; + type cockpit_unit_file_t; + ') + @@ -14918,6 +14924,9 @@ index 0000000..eb2739a + files_search_var_lib($1) + admin_pattern($1, cockpit_var_lib_t) + ++ files_search_pids($1) ++ admin_pattern($1, cockpit_var_run_t) ++ + cockpit_systemctl($1) + admin_pattern($1, cockpit_unit_file_t) + allow $1 cockpit_unit_file_t:service all_service_perms; @@ -14928,10 +14937,10 @@ index 0000000..eb2739a +') diff --git a/cockpit.te b/cockpit.te new file mode 100644 -index 0000000..4ae76c5 +index 0000000..77cdd5e --- /dev/null +++ b/cockpit.te -@@ -0,0 +1,102 @@ +@@ -0,0 +1,111 @@ +policy_module(cockpit, 1.0.0) + +######################################## @@ -14946,6 +14955,9 @@ index 0000000..4ae76c5 +type cockpit_tmp_t; +files_tmp_file(cockpit_tmp_t) + ++type cockpit_var_run_t; ++files_pid_file(cockpit_var_run_t) ++ +type cockpit_unit_file_t; +systemd_unit_file(cockpit_unit_file_t) + @@ -14982,6 +14994,12 @@ index 0000000..4ae76c5 +manage_files_pattern(cockpit_ws_t, cockpit_tmp_t, cockpit_tmp_t) +files_tmp_filetrans(cockpit_ws_t, cockpit_tmp_t, { dir file }) + ++manage_dirs_pattern(cockpit_ws_t, cockpit_var_run_t, cockpit_var_run_t) ++manage_files_pattern(cockpit_ws_t, cockpit_var_run_t, cockpit_var_run_t) ++manage_lnk_files_pattern(cockpit_ws_t, cockpit_var_run_t, cockpit_var_run_t) ++manage_sock_files_pattern(cockpit_ws_t, cockpit_var_run_t, cockpit_var_run_t) ++files_pid_filetrans(cockpit_ws_t, cockpit_var_run_t, { file dir sock_file }) ++ +read_files_pattern(cockpit_ws_t, cockpit_var_lib_t, cockpit_var_lib_t) +list_dirs_pattern(cockpit_ws_t, cockpit_var_lib_t, cockpit_var_lib_t) + @@ -30281,10 +30299,10 @@ index 0000000..cf9f7bf +') diff --git a/geoclue.te b/geoclue.te new file mode 100644 -index 0000000..cd197a6 +index 0000000..2d357a2 --- /dev/null +++ b/geoclue.te -@@ -0,0 +1,66 @@ +@@ -0,0 +1,69 @@ +policy_module(geoclue, 1.0.0) + +######################################## @@ -30341,6 +30359,9 @@ index 0000000..cd197a6 + dbus_system_domain(geoclue_t, geoclue_exec_t) + + optional_policy(` ++ avahi_dbus_chat(geoclue_t) ++ ') ++ optional_policy(` + modemmanager_dbus_chat(geoclue_t) + ') + optional_policy(` @@ -67235,14 +67256,15 @@ index 0000000..509d898 + ') +') diff --git a/pegasus.fc b/pegasus.fc -index dfd46e4..d40433a 100644 +index dfd46e4..feaa8e1 100644 --- a/pegasus.fc +++ b/pegasus.fc -@@ -1,15 +1,32 @@ +@@ -1,15 +1,33 @@ -/etc/Pegasus(/.*)? gen_context(system_u:object_r:pegasus_conf_t,s0) + +/etc/Pegasus(/.*)? gen_context(system_u:object_r:pegasus_conf_t,s0) /etc/Pegasus/pegasus_current\.conf gen_context(system_u:object_r:pegasus_data_t,s0) ++/etc/Pegasus/cimserver_current\.conf gen_context(system_u:object_r:pegasus_data_t,s0) -/etc/rc\.d/init\.d/tog-pegasus -- gen_context(system_u:object_r:pegasus_initrc_exec_t,s0) +/usr/sbin/cimserver -- gen_context(system_u:object_r:pegasus_exec_t,s0) @@ -84222,7 +84244,7 @@ index 47de2d6..dfb3396 100644 +/var/log/pacemaker\.log.* -- gen_context(system_u:object_r:cluster_var_log_t,s0) +/var/log/pcsd(/.*)? gen_context(system_u:object_r:cluster_var_log_t,s0) diff --git a/rhcs.if b/rhcs.if -index c8bdea2..29df561 100644 +index c8bdea2..1574225 100644 --- a/rhcs.if +++ b/rhcs.if @@ -1,19 +1,19 @@ @@ -84437,12 +84459,33 @@ index c8bdea2..29df561 100644 ## ## ## -@@ -221,10 +252,28 @@ interface(`rhcs_stream_connect_fenced',` +@@ -221,10 +252,49 @@ interface(`rhcs_stream_connect_fenced',` stream_connect_pattern($1, fenced_var_run_t, fenced_var_run_t, fenced_t) ') +###################################### +## ++## Send and receive messages from ++## fenced over dbus. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`rhcs_dbus_chat_fenced',` ++ gen_require(` ++ type fenced_t; ++ class dbus send_msg; ++ ') ++ ++ allow $1 fenced_t:dbus send_msg; ++ allow fenced_t $1:dbus send_msg; ++') ++ ++###################################### ++## +## Execute a domain transition to run fenced. +## +## @@ -84468,7 +84511,7 @@ index c8bdea2..29df561 100644 ## ## ## -@@ -243,7 +292,7 @@ interface(`rhcs_domtrans_gfs_controld',` +@@ -243,7 +313,7 @@ interface(`rhcs_domtrans_gfs_controld',` #################################### ## @@ -84477,7 +84520,7 @@ index c8bdea2..29df561 100644 ## ## ## -@@ -264,7 +313,7 @@ interface(`rhcs_rw_gfs_controld_semaphores',` +@@ -264,7 +334,7 @@ interface(`rhcs_rw_gfs_controld_semaphores',` ######################################## ## @@ -84486,7 +84529,7 @@ index c8bdea2..29df561 100644 ## ## ## -@@ -285,8 +334,7 @@ interface(`rhcs_rw_gfs_controld_shm',` +@@ -285,8 +355,7 @@ interface(`rhcs_rw_gfs_controld_shm',` ##################################### ## @@ -84496,7 +84539,7 @@ index c8bdea2..29df561 100644 ## ## ## -@@ -324,8 +372,8 @@ interface(`rhcs_domtrans_groupd',` +@@ -324,8 +393,8 @@ interface(`rhcs_domtrans_groupd',` ##################################### ## @@ -84507,7 +84550,7 @@ index c8bdea2..29df561 100644 ## ## ## -@@ -342,10 +390,51 @@ interface(`rhcs_stream_connect_groupd',` +@@ -342,10 +411,51 @@ interface(`rhcs_stream_connect_groupd',` stream_connect_pattern($1, groupd_var_run_t, groupd_var_run_t, groupd_t) ') @@ -84561,7 +84604,7 @@ index c8bdea2..29df561 100644 ## ## ## -@@ -366,8 +455,7 @@ interface(`rhcs_rw_cluster_shm',` +@@ -366,8 +476,7 @@ interface(`rhcs_rw_cluster_shm',` #################################### ## @@ -84571,7 +84614,7 @@ index c8bdea2..29df561 100644 ## ## ## -@@ -383,9 +471,10 @@ interface(`rhcs_rw_cluster_semaphores',` +@@ -383,9 +492,10 @@ interface(`rhcs_rw_cluster_semaphores',` allow $1 cluster_domain:sem { rw_sem_perms destroy }; ') @@ -84584,7 +84627,7 @@ index c8bdea2..29df561 100644 ## ## ## -@@ -393,20 +482,44 @@ interface(`rhcs_rw_cluster_semaphores',` +@@ -393,20 +503,44 @@ interface(`rhcs_rw_cluster_semaphores',` ## ## # @@ -84635,7 +84678,7 @@ index c8bdea2..29df561 100644 ## ## ## -@@ -414,15 +527,12 @@ interface(`rhcs_rw_groupd_semaphores',` +@@ -414,15 +548,12 @@ interface(`rhcs_rw_groupd_semaphores',` ## ## # @@ -84654,7 +84697,7 @@ index c8bdea2..29df561 100644 ') ###################################### -@@ -446,52 +556,385 @@ interface(`rhcs_domtrans_qdiskd',` +@@ -446,52 +577,385 @@ interface(`rhcs_domtrans_qdiskd',` ######################################## ## @@ -84686,14 +84729,22 @@ index c8bdea2..29df561 100644 ## -## Role allowed access. +## Domain allowed access. -+## -+## -+# + ## + ## +-## + # +-interface(`rhcs_admin',` +interface(`rhcs_read_cluster_lib_files',` -+ gen_require(` + gen_require(` +- attribute cluster_domain, cluster_pid, cluster_tmpfs; +- attribute cluster_log; +- type dlm_controld_initrc_exec_t, foghorn_initrc_exec_t, fenced_lock_t; +- type fenced_tmp_t, qdiskd_var_lib_t; + type cluster_var_lib_t; -+ ') -+ + ') + +- allow $1 cluster_domain:process { ptrace signal_perms }; +- ps_process_pattern($1, cluster_domain) + files_search_var_lib($1) + read_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') @@ -84712,11 +84763,17 @@ index c8bdea2..29df561 100644 + gen_require(` + type cluster_var_lib_t; + ') -+ + +- init_labeled_script_domtrans($1, { dlm_controld_initrc_exec_t foghorn_initrc_exec_t }) +- domain_system_change_exemption($1) +- role_transition $2 { dlm_controld_initrc_exec_t foghorn_initrc_exec_t } system_r; +- allow $2 system_r; + files_search_var_lib($1) + manage_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') -+ + +- files_search_pids($1) +- admin_pattern($1, cluster_pid) +#################################### +## +## Allow domain to relabel cluster lib files @@ -84736,7 +84793,9 @@ index c8bdea2..29df561 100644 + relabelto_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) + relabelfrom_files_pattern($1, cluster_var_lib_t, cluster_var_lib_t) +') -+ + +- files_search_locks($1) +- admin_pattern($1, fenced_lock_t) +###################################### +## +## Execute a domain transition to run cluster administrative domain. @@ -84751,11 +84810,15 @@ index c8bdea2..29df561 100644 + gen_require(` + type cluster_t, cluster_exec_t; + ') -+ + +- files_search_tmp($1) +- admin_pattern($1, fenced_tmp_t) + corecmd_search_bin($1) + domtrans_pattern($1, cluster_exec_t, cluster_t) +') -+ + +- files_search_var_lib($1) +- admin_pattern($1, qdiskd_var_lib_t) +####################################### +## +## Execute cluster init scripts in @@ -84771,7 +84834,9 @@ index c8bdea2..29df561 100644 + gen_require(` + type cluster_initrc_exec_t; + ') -+ + +- fs_search_tmpfs($1) +- admin_pattern($1, cluster_tmpfs) + init_labeled_script_domtrans($1, cluster_initrc_exec_t) +') + @@ -84978,37 +85043,21 @@ index c8bdea2..29df561 100644 +## +## +## Domain allowed access. - ## - ## --## - # --interface(`rhcs_admin',` ++## ++## ++# +interface(`rhcs_dbus_chat_cluster',` - gen_require(` -- attribute cluster_domain, cluster_pid, cluster_tmpfs; -- attribute cluster_log; -- type dlm_controld_initrc_exec_t, foghorn_initrc_exec_t, fenced_lock_t; -- type fenced_tmp_t, qdiskd_var_lib_t; ++ gen_require(` + type cluster_t; + class dbus send_msg; - ') - -- allow $1 cluster_domain:process { ptrace signal_perms }; -- ps_process_pattern($1, cluster_domain) ++ ') ++ + allow $1 cluster_t:dbus send_msg; + allow cluster_t $1:dbus send_msg; +') - -- init_labeled_script_domtrans($1, { dlm_controld_initrc_exec_t foghorn_initrc_exec_t }) -- domain_system_change_exemption($1) -- role_transition $2 { dlm_controld_initrc_exec_t foghorn_initrc_exec_t } system_r; -- allow $2 system_r; - -- files_search_pids($1) -- admin_pattern($1, cluster_pid) - -- files_search_locks($1) -- admin_pattern($1, fenced_lock_t) ++ ++ ++ +##################################### +## +## All of the rules required to administrate @@ -85032,20 +85081,14 @@ index c8bdea2..29df561 100644 + type cluster_tmpfs_t, cluster_var_log_t, cluster_var_run_t; + type cluster_unit_file_t; + ') - -- files_search_tmp($1) -- admin_pattern($1, fenced_tmp_t) ++ + allow $1 cluster_t:process signal_perms; + ps_process_pattern($1, cluster_t) - -- files_search_var_lib($1) -- admin_pattern($1, qdiskd_var_lib_t) ++ + tunable_policy(`deny_ptrace',`',` + allow $1 cluster_t:process ptrace; + ') - -- fs_search_tmpfs($1) -- admin_pattern($1, cluster_tmpfs) ++ + init_labeled_script_domtrans($1, cluster_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 cluster_initrc_exec_t system_r; @@ -85069,7 +85112,7 @@ index c8bdea2..29df561 100644 + allow $1 cluster_unit_file_t:service all_service_perms; ') diff --git a/rhcs.te b/rhcs.te -index 6cf79c4..2c7b543 100644 +index 6cf79c4..1fafe47 100644 --- a/rhcs.te +++ b/rhcs.te @@ -20,6 +20,35 @@ gen_tunable(fenced_can_network_connect, false) @@ -85540,7 +85583,7 @@ index 6cf79c4..2c7b543 100644 ####################################### # # foghorn local policy -@@ -221,16 +535,18 @@ corenet_sendrecv_agentx_client_packets(foghorn_t) +@@ -221,16 +535,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t) corenet_tcp_connect_agentx_port(foghorn_t) corenet_tcp_sendrecv_agentx_port(foghorn_t) @@ -85553,6 +85596,10 @@ index 6cf79c4..2c7b543 100644 optional_policy(` dbus_connect_system_bus(foghorn_t) ++ ++ optional_policy(` ++ rhcs_dbus_chat_fenced(foghorn_t) ++ ') ') optional_policy(` @@ -85561,7 +85608,7 @@ index 6cf79c4..2c7b543 100644 snmp_stream_connect(foghorn_t) ') -@@ -247,16 +563,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_ +@@ -247,16 +567,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_ stream_connect_pattern(gfs_controld_t, fenced_var_run_t, fenced_var_run_t, fenced_t) stream_connect_pattern(gfs_controld_t, groupd_var_run_t, groupd_var_run_t, groupd_t) @@ -85583,7 +85630,7 @@ index 6cf79c4..2c7b543 100644 optional_policy(` lvm_exec(gfs_controld_t) dev_rw_lvm_control(gfs_controld_t) -@@ -275,10 +595,57 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) +@@ -275,10 +599,57 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) dev_list_sysfs(groupd_t) @@ -85643,7 +85690,7 @@ index 6cf79c4..2c7b543 100644 ###################################### # # qdiskd local policy -@@ -292,7 +659,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) +@@ -292,7 +663,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) manage_sock_files_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) files_var_lib_filetrans(qdiskd_t, qdiskd_var_lib_t, { file dir sock_file }) @@ -85651,7 +85698,7 @@ index 6cf79c4..2c7b543 100644 kernel_read_software_raid_state(qdiskd_t) kernel_getattr_core_if(qdiskd_t) -@@ -321,6 +687,8 @@ storage_raw_write_fixed_disk(qdiskd_t) +@@ -321,6 +691,8 @@ storage_raw_write_fixed_disk(qdiskd_t) auth_use_nsswitch(qdiskd_t) @@ -108362,7 +108409,7 @@ index a4f20bc..374e8ef 100644 +/var/log/qemu-ga\.log.* -- gen_context(system_u:object_r:virt_qemu_ga_log_t,s0) +/var/log/qemu-ga(/.*)? gen_context(system_u:object_r:virt_qemu_ga_log_t,s0) diff --git a/virt.if b/virt.if -index facdee8..eae2073 100644 +index facdee8..19b6ffb 100644 --- a/virt.if +++ b/virt.if @@ -1,318 +1,226 @@ @@ -109184,7 +109231,7 @@ index facdee8..eae2073 100644 ## ## ## -@@ -673,54 +534,398 @@ interface(`virt_home_filetrans',` +@@ -673,54 +534,454 @@ interface(`virt_home_filetrans',` ## ## # @@ -109556,6 +109603,26 @@ index facdee8..eae2073 100644 + +####################################### +## ++## Read Sandbox Files ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`virt_read_sandbox_files',` ++ gen_require(` ++ type svirt_sandbox_file_t; ++ ') ++ ++ list_dirs_pattern($1, svirt_sandbox_file_t, svirt_sandbox_file_t) ++ read_files_pattern($1, svirt_sandbox_file_t, svirt_sandbox_file_t) ++ read_lnk_files_pattern($1, svirt_sandbox_file_t, svirt_sandbox_file_t) ++') ++ ++####################################### ++## +## Manage Sandbox Files +## +## @@ -109579,6 +109646,24 @@ index facdee8..eae2073 100644 + +####################################### +## ++## Getattr Sandbox File systems ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`virt_getattr_sandbox_filesystem',` ++ gen_require(` ++ type svirt_sandbox_file_t; ++ ') ++ ++ allow $1 svirt_sandbox_file_t:filesystem getattr; ++') ++ ++####################################### ++## +## Relabel Sandbox File systems +## +## @@ -109590,6 +109675,24 @@ index facdee8..eae2073 100644 +interface(`virt_relabel_sandbox_filesystem',` + gen_require(` + type svirt_sandbox_file_t; ++ ') ++ ++ allow $1 svirt_sandbox_file_t:filesystem { relabelfrom relabelto }; ++') ++ ++####################################### ++## ++## Mounton Sandbox Files ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`virt_mounton_sandbox_file',` ++ gen_require(` ++ type svirt_sandbox_file_t; ') - tunable_policy(`virt_use_samba',` @@ -109597,25 +109700,26 @@ index facdee8..eae2073 100644 - fs_manage_cifs_files($1) - fs_manage_cifs_symlinks($1) - ') -+ allow $1 svirt_sandbox_file_t:filesystem { relabelfrom relabelto }; ++ allow $1 svirt_sandbox_file_t:dir_file_class_set mounton; ') -######################################## +####################################### ## -## Relabel virt home content. -+## Mounton Sandbox Files ++## Connect to virt over a unix domain stream socket. ## ## ## -@@ -728,72 +933,98 @@ interface(`virt_manage_generic_virt_home_content',` +@@ -728,52 +989,80 @@ interface(`virt_manage_generic_virt_home_content',` ## ## # -interface(`virt_relabel_generic_virt_home_content',` -+interface(`virt_mounton_sandbox_file',` ++interface(`virt_stream_connect_sandbox',` gen_require(` - type virt_home_t; ++ attribute svirt_sandbox_domain; + type svirt_sandbox_file_t; ') @@ -109625,66 +109729,43 @@ index facdee8..eae2073 100644 - allow $1 virt_home_t:fifo_file relabel_fifo_file_perms; - allow $1 virt_home_t:lnk_file relabel_lnk_file_perms; - allow $1 virt_home_t:sock_file relabel_sock_file_perms; -+ allow $1 svirt_sandbox_file_t:dir_file_class_set mounton; ++ files_search_pids($1) ++ stream_connect_pattern($1, svirt_sandbox_file_t, svirt_sandbox_file_t, svirt_sandbox_domain) ++ ps_process_pattern(svirt_sandbox_domain, $1) ') --######################################## -+####################################### + ######################################## ## -## Create specified objects in user home -## directories with the generic virt -## home type. -+## Connect to virt over a unix domain stream socket. - ## - ## - ## - ## Domain allowed access. - ## - ## --## -+# -+interface(`virt_stream_connect_sandbox',` -+ gen_require(` -+ attribute svirt_sandbox_domain; -+ type svirt_sandbox_file_t; -+ ') -+ -+ files_search_pids($1) -+ stream_connect_pattern($1, svirt_sandbox_file_t, svirt_sandbox_file_t, svirt_sandbox_domain) -+ ps_process_pattern(svirt_sandbox_domain, $1) -+') -+ -+######################################## -+## +## Execute qemu in the svirt domain, and +## allow the specified role the svirt domain. -+## -+## + ## + ## ## --## Class of the object being created. +-## Domain allowed access. +## Domain allowed access ## ## --## +-## +## ## --## The name of the object being created. +-## Class of the object being created. +## The role to be allowed the sandbox domain. ## ## +-## +## - # --interface(`virt_home_filetrans_virt_home',` ++# +interface(`virt_transition_svirt',` - gen_require(` -- type virt_home_t; ++ gen_require(` + attribute virt_domain; + type virt_bridgehelper_t; + type svirt_image_t; + type svirt_socket_t; - ') - -- userdom_user_home_dir_filetrans($1, virt_home_t, $2, $3) ++ ') ++ + allow $1 virt_domain:process transition; + role $2 types virt_domain; + role $2 types virt_bridgehelper_t; @@ -109699,70 +109780,91 @@ index facdee8..eae2073 100644 + optional_policy(` + ptchown_run(virt_domain, $2) + ') ++') ++ ++######################################## ++## ++## Do not audit attempts to write virt daemon unnamed pipes. ++## ++## + ## +-## The name of the object being created. ++## Domain to not audit. + ## + ## + # +-interface(`virt_home_filetrans_virt_home',` ++interface(`virt_dontaudit_write_pipes',` + gen_require(` +- type virt_home_t; ++ type virtd_t; + ') + +- userdom_user_home_dir_filetrans($1, virt_home_t, $2, $3) ++ dontaudit $1 virtd_t:fd use; ++ dontaudit $1 virtd_t:fifo_file write_fifo_file_perms; ') ######################################## ## -## Read virt pid files. -+## Do not audit attempts to write virt daemon unnamed pipes. ++## Send a sigkill to virtual machines ## ## ## --## Domain allowed access. -+## Domain to not audit. +@@ -781,19 +1070,17 @@ interface(`virt_home_filetrans_virt_home',` ## ## # -interface(`virt_read_pid_files',` -+interface(`virt_dontaudit_write_pipes',` ++interface(`virt_kill_svirt',` gen_require(` - type virt_var_run_t; -+ type virtd_t; ++ attribute virt_domain; ') - files_search_pids($1) - read_files_pattern($1, virt_var_run_t, virt_var_run_t) -+ dontaudit $1 virtd_t:fd use; -+ dontaudit $1 virtd_t:fifo_file write_fifo_file_perms; ++ allow $1 virt_domain:process sigkill; ') ######################################## ## -## Create, read, write, and delete -## virt pid files. -+## Send a sigkill to virtual machines ++## Send a sigkill to virtd daemon. ## ## ## -@@ -801,18 +1032,17 @@ interface(`virt_read_pid_files',` +@@ -801,18 +1088,17 @@ interface(`virt_read_pid_files',` ## ## # -interface(`virt_manage_pid_files',` -+interface(`virt_kill_svirt',` ++interface(`virt_kill',` gen_require(` - type virt_var_run_t; -+ attribute virt_domain; ++ type virtd_t; ') - files_search_pids($1) - manage_files_pattern($1, virt_var_run_t, virt_var_run_t) -+ allow $1 virt_domain:process sigkill; ++ allow $1 virtd_t:process sigkill; ') ######################################## ## -## Search virt lib directories. -+## Send a sigkill to virtd daemon. ++## Send a signal to virtd daemon. ## ## ## -@@ -820,18 +1050,17 @@ interface(`virt_manage_pid_files',` +@@ -820,18 +1106,17 @@ interface(`virt_manage_pid_files',` ## ## # -interface(`virt_search_lib',` -+interface(`virt_kill',` ++interface(`virt_signal',` gen_require(` - type virt_var_lib_t; + type virtd_t; @@ -109770,22 +109872,22 @@ index facdee8..eae2073 100644 - files_search_var_lib($1) - allow $1 virt_var_lib_t:dir search_dir_perms; -+ allow $1 virtd_t:process sigkill; ++ allow $1 virtd_t:process signal; ') ######################################## ## -## Read virt lib files. -+## Send a signal to virtd daemon. ++## Send null signal to virtd daemon. ## ## ## -@@ -839,20 +1068,17 @@ interface(`virt_search_lib',` +@@ -839,20 +1124,17 @@ interface(`virt_search_lib',` ## ## # -interface(`virt_read_lib_files',` -+interface(`virt_signal',` ++interface(`virt_signull',` gen_require(` - type virt_var_lib_t; + type virtd_t; @@ -109794,38 +109896,38 @@ index facdee8..eae2073 100644 - files_search_var_lib($1) - read_files_pattern($1, virt_var_lib_t, virt_var_lib_t) - read_lnk_files_pattern($1, virt_var_lib_t, virt_var_lib_t) -+ allow $1 virtd_t:process signal; ++ allow $1 virtd_t:process signull; ') ######################################## ## -## Create, read, write, and delete -## virt lib files. -+## Send null signal to virtd daemon. ++## Send a signal to virtual machines ## ## ## -@@ -860,94 +1086,93 @@ interface(`virt_read_lib_files',` +@@ -860,74 +1142,123 @@ interface(`virt_read_lib_files',` ## ## # -interface(`virt_manage_lib_files',` -+interface(`virt_signull',` ++interface(`virt_signal_svirt',` gen_require(` - type virt_var_lib_t; -+ type virtd_t; ++ attribute virt_domain; ') - files_search_var_lib($1) - manage_files_pattern($1, virt_var_lib_t, virt_var_lib_t) -+ allow $1 virtd_t:process signull; ++ allow $1 virt_domain:process signal; ') ######################################## ## -## Create objects in virt pid -## directories with a private type. -+## Send a signal to virtual machines ++## Send a signal to sandbox domains ## ## ## @@ -109833,182 +109935,224 @@ index facdee8..eae2073 100644 ## ## -## --## ++# ++interface(`virt_signal_sandbox',` ++ gen_require(` ++ attribute svirt_sandbox_domain; ++ ') ++ ++ allow $1 svirt_sandbox_domain:process signal; ++') ++ ++######################################## ++## ++## Manage virt home files. ++## ++## + ## -## The type of the object to be created. --## --## ++## Domain allowed access. + ## + ## -## --## ++# ++interface(`virt_manage_home_files',` ++ gen_require(` ++ type virt_home_t; ++ ') ++ ++ userdom_search_user_home_dirs($1) ++ manage_files_pattern($1, virt_home_t, virt_home_t) ++') ++ ++######################################## ++## ++## allow domain to read ++## virt tmpfs files ++## ++## + ## -## The object class of the object being created. --## --## ++## Domain allowed access + ## + ## -## +# -+interface(`virt_signal_svirt',` ++interface(`virt_read_tmpfs_files',` + gen_require(` -+ attribute virt_domain; ++ attribute virt_tmpfs_type; + ') + -+ allow $1 virt_domain:process signal; ++ allow $1 virt_tmpfs_type:file read_file_perms; +') + +######################################## +## -+## Manage virt home files. ++## allow domain to manage ++## virt tmpfs files +## +## ## -## The name of the object being created. -+## Domain allowed access. ++## Domain allowed access ## ## -## # -interface(`virt_pid_filetrans',` -+interface(`virt_manage_home_files',` ++interface(`virt_manage_tmpfs_files',` gen_require(` - type virt_var_run_t; -+ type virt_home_t; ++ attribute virt_tmpfs_type; ') - files_search_pids($1) - filetrans_pattern($1, virt_var_run_t, $2, $3, $4) -+ userdom_search_user_home_dirs($1) -+ manage_files_pattern($1, virt_home_t, virt_home_t) ++ allow $1 virt_tmpfs_type:file manage_file_perms; ') ######################################## ## -## Read virt log files. -+## allow domain to read -+## virt tmpfs files ++## Create .virt directory in the user home directory ++## with an correct label. ## ## ## --## Domain allowed access. -+## Domain allowed access + ## Domain allowed access. ## ## -## # -interface(`virt_read_log',` -+interface(`virt_read_tmpfs_files',` ++interface(`virt_filetrans_home_content',` gen_require(` - type virt_log_t; -+ attribute virt_tmpfs_type; ++ type virt_home_t; ++ type svirt_home_t; ') - logging_search_logs($1) - read_files_pattern($1, virt_log_t, virt_log_t) -+ allow $1 virt_tmpfs_type:file read_file_perms; ++ userdom_user_home_dir_filetrans($1, virt_home_t, dir, ".libvirt") ++ userdom_user_home_dir_filetrans($1, virt_home_t, dir, ".virtinst") ++ filetrans_pattern($1, virt_home_t, svirt_home_t, dir, "qemu") ++ ++ optional_policy(` ++ gnome_config_filetrans($1, virt_home_t, dir, "libvirt") ++ gnome_cache_filetrans($1, virt_home_t, dir, "libvirt") ++ gnome_cache_filetrans($1, virt_home_t, dir, "libvirt-sandbox") ++ gnome_cache_filetrans($1, virt_home_t, dir, "gnome-boxes") ++ gnome_data_filetrans($1, svirt_home_t, dir, "images") ++ gnome_data_filetrans($1, svirt_home_t, dir, "boot") ++ ') ') ######################################## ## -## Append virt log files. -+## allow domain to manage -+## virt tmpfs files ++## Dontaudit attempts to Read virt_image_type devices. ## ## ## --## Domain allowed access. -+## Domain allowed access +@@ -935,117 +1266,133 @@ interface(`virt_read_log',` ## ## # -interface(`virt_append_log',` -+interface(`virt_manage_tmpfs_files',` ++interface(`virt_dontaudit_read_chr_dev',` gen_require(` - type virt_log_t; -+ attribute virt_tmpfs_type; ++ attribute virt_image_type; ') - logging_search_logs($1) - append_files_pattern($1, virt_log_t, virt_log_t) -+ allow $1 virt_tmpfs_type:file manage_file_perms; ++ dontaudit $1 virt_image_type:chr_file read_chr_file_perms; ') ######################################## ## -## Create, read, write, and delete -## virt log files. -+## Create .virt directory in the user home directory -+## with an correct label. ++## Creates types and rules for a basic ++## virt_lxc process domain. ## - ## +-## ++## ## -@@ -955,20 +1180,29 @@ interface(`virt_append_log',` +-## Domain allowed access. ++## Prefix for the domain. ## ## # -interface(`virt_manage_log',` -+interface(`virt_filetrans_home_content',` ++template(`virt_sandbox_domain_template',` gen_require(` - type virt_log_t; -+ type virt_home_t; -+ type svirt_home_t; ++ attribute svirt_sandbox_domain; ') - logging_search_logs($1) - manage_dirs_pattern($1, virt_log_t, virt_log_t) - manage_files_pattern($1, virt_log_t, virt_log_t) - manage_lnk_files_pattern($1, virt_log_t, virt_log_t) -+ userdom_user_home_dir_filetrans($1, virt_home_t, dir, ".libvirt") -+ userdom_user_home_dir_filetrans($1, virt_home_t, dir, ".virtinst") -+ filetrans_pattern($1, virt_home_t, svirt_home_t, dir, "qemu") ++ type $1_t, svirt_sandbox_domain; ++ domain_type($1_t) ++ domain_user_exemption_target($1_t) ++ mls_rangetrans_target($1_t) ++ mcs_constrained($1_t) ++ role system_r types $1_t; + -+ optional_policy(` -+ gnome_config_filetrans($1, virt_home_t, dir, "libvirt") -+ gnome_cache_filetrans($1, virt_home_t, dir, "libvirt") -+ gnome_cache_filetrans($1, virt_home_t, dir, "libvirt-sandbox") -+ gnome_cache_filetrans($1, virt_home_t, dir, "gnome-boxes") -+ gnome_data_filetrans($1, svirt_home_t, dir, "images") -+ gnome_data_filetrans($1, svirt_home_t, dir, "boot") -+ ') ++ logging_send_syslog_msg($1_t) ++ ++ kernel_read_system_state($1_t) ') ######################################## ## -## Search virt image directories. -+## Dontaudit attempts to Read virt_image_type devices. ++## Make the specified type usable as a lxc domain ## - ## +-## ++## ## -@@ -976,92 +1210,133 @@ interface(`virt_manage_log',` +-## Domain allowed access. ++## Type to be used as a lxc domain ## ## # -interface(`virt_search_images',` -+interface(`virt_dontaudit_read_chr_dev',` ++template(`virt_sandbox_domain',` gen_require(` - attribute virt_image_type; +- attribute virt_image_type; ++ attribute svirt_sandbox_domain; ') - virt_search_lib($1) - allow $1 virt_image_type:dir search_dir_perms; -+ dontaudit $1 virt_image_type:chr_file read_chr_file_perms; ++ typeattribute $1 svirt_sandbox_domain; ') ######################################## ## -## Read virt image files. -+## Creates types and rules for a basic -+## virt_lxc process domain. ++## Execute a qemu_exec_t in the callers domain ## --## -+## - ## --## Domain allowed access. -+## Prefix for the domain. - ## + ## +-## ++## + ## Domain allowed access. +-## ++## ## # -interface(`virt_read_images',` -+template(`virt_sandbox_domain_template',` ++interface(`virt_exec_qemu',` gen_require(` - type virt_var_lib_t; - attribute virt_image_type; -+ attribute svirt_sandbox_domain; ++ type qemu_exec_t; ') - virt_search_lib($1) @@ -110017,125 +110161,98 @@ index facdee8..eae2073 100644 - read_files_pattern($1, virt_image_type, virt_image_type) - read_lnk_files_pattern($1, virt_image_type, virt_image_type) - read_blk_files_pattern($1, virt_image_type, virt_image_type) -+ type $1_t, svirt_sandbox_domain; -+ domain_type($1_t) -+ domain_user_exemption_target($1_t) -+ mls_rangetrans_target($1_t) -+ mcs_constrained($1_t) -+ role system_r types $1_t; ++ can_exec($1, qemu_exec_t) ++') - tunable_policy(`virt_use_nfs',` - fs_list_nfs($1) - fs_read_nfs_files($1) - fs_read_nfs_symlinks($1) -+ logging_send_syslog_msg($1_t) -+ -+ kernel_read_system_state($1_t) -+') -+ +######################################## +## -+## Make the specified type usable as a lxc domain ++## Transition to virt named content +## -+## ++## +## -+## Type to be used as a lxc domain ++## Domain allowed access. +## +## +# -+template(`virt_sandbox_domain',` ++interface(`virt_filetrans_named_content',` + gen_require(` -+ attribute svirt_sandbox_domain; ++ type virt_lxc_var_run_t; ++ type virt_var_run_t; ') - tunable_policy(`virt_use_samba',` - fs_list_cifs($1) - fs_read_cifs_files($1) - fs_read_cifs_symlinks($1) -+ typeattribute $1 svirt_sandbox_domain; -+') -+ -+######################################## -+## -+## Execute a qemu_exec_t in the callers domain -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`virt_exec_qemu',` -+ gen_require(` -+ type qemu_exec_t; - ') -+ -+ can_exec($1, qemu_exec_t) +- ') ++ files_pid_filetrans($1, virt_lxc_var_run_t, dir, "libvirt-sandbox") ++ files_pid_filetrans($1, virt_var_run_t, dir, "libvirt") ++ files_pid_filetrans($1, virt_var_run_t, dir, "libguestfs") ') ######################################## ## -## Read and write all virt image -## character files. -+## Transition to virt named content ++## Execute qemu in the svirt domain, and ++## allow the specified role the svirt domain. ## ## ## -## Domain allowed access. -+## Domain allowed access. ++## Domain allowed access ++## ++## ++## ++## ++## The role to be allowed the sandbox domain. ## ## ++## # -interface(`virt_rw_all_image_chr_files',` -+interface(`virt_filetrans_named_content',` ++interface(`virt_transition_svirt_sandbox',` gen_require(` - attribute virt_image_type; -+ type virt_lxc_var_run_t; -+ type virt_var_run_t; ++ attribute svirt_sandbox_domain; ') - virt_search_lib($1) - allow $1 virt_image_type:dir list_dir_perms; - rw_chr_files_pattern($1, virt_image_type, virt_image_type) -+ files_pid_filetrans($1, virt_lxc_var_run_t, dir, "libvirt-sandbox") -+ files_pid_filetrans($1, virt_var_run_t, dir, "libvirt") -+ files_pid_filetrans($1, virt_var_run_t, dir, "libguestfs") ++ allow $1 svirt_sandbox_domain:process { transition signal_perms }; ++ role $2 types svirt_sandbox_domain; ++ allow $1 svirt_sandbox_domain:unix_dgram_socket sendto; ++ ++ allow svirt_sandbox_domain $1:fifo_file rw_fifo_file_perms; ++ allow svirt_sandbox_domain $1:process sigchld; ++ ps_process_pattern($1, svirt_sandbox_domain) ') ######################################## ## -## Create, read, write, and delete -## svirt cache files. -+## Execute qemu in the svirt domain, and -+## allow the specified role the svirt domain. ++## Read the process state of virt sandbox containers ## ## ## --## Domain allowed access. -+## Domain allowed access -+## -+## -+## -+## -+## The role to be allowed the sandbox domain. +@@ -1053,15 +1400,17 @@ interface(`virt_rw_all_image_chr_files',` ## ## -+## # -interface(`virt_manage_svirt_cache',` - refpolicywarn(`$0($*) has been deprecated, use virt_manage_virt_cache() instead.') - virt_manage_virt_cache($1) -+interface(`virt_transition_svirt_sandbox',` ++interface(`virt_sandbox_read_state',` + gen_require(` + attribute svirt_sandbox_domain; + ') + -+ allow $1 svirt_sandbox_domain:process { transition signal_perms }; -+ role $2 types svirt_sandbox_domain; -+ allow $1 svirt_sandbox_domain:unix_dgram_socket sendto; -+ -+ allow svirt_sandbox_domain $1:fifo_file rw_fifo_file_perms; -+ allow svirt_sandbox_domain $1:process sigchld; + ps_process_pattern($1, svirt_sandbox_domain) ') @@ -110147,7 +110264,7 @@ index facdee8..eae2073 100644 ## ## ## -@@ -1069,21 +1344,17 @@ interface(`virt_manage_svirt_cache',` +@@ -1069,21 +1418,17 @@ interface(`virt_manage_svirt_cache',` ## ## # @@ -110173,7 +110290,7 @@ index facdee8..eae2073 100644 ## ## ## -@@ -1091,36 +1362,36 @@ interface(`virt_manage_virt_cache',` +@@ -1091,36 +1436,36 @@ interface(`virt_manage_virt_cache',` ## ## # @@ -110230,7 +110347,7 @@ index facdee8..eae2073 100644 ## ## ## -@@ -1136,50 +1407,95 @@ interface(`virt_manage_images',` +@@ -1136,50 +1481,76 @@ interface(`virt_manage_images',` # interface(`virt_admin',` gen_require(` @@ -110269,20 +110386,26 @@ index facdee8..eae2073 100644 - fs_search_tmpfs($1) - admin_pattern($1, virt_tmpfs_type) -+ allow $1 virt_domain:process signal_perms; - +- - files_search_tmp($1) - admin_pattern($1, { virt_tmp_type virt_tmp_t }) +- +- files_search_etc($1) +- admin_pattern($1, { virt_etc_t virt_etc_rw_t virtd_keytab_t }) ++ allow $1 virt_domain:process signal_perms; + +- logging_search_logs($1) +- admin_pattern($1, virt_log_t) + admin_pattern($1, virt_file_type) + admin_pattern($1, svirt_file_type) -- files_search_etc($1) -- admin_pattern($1, { virt_etc_t virt_etc_rw_t virtd_keytab_t }) +- files_search_pids($1) +- admin_pattern($1, { virt_var_run_t virtd_lxc_var_run_t svirt_var_run_t }) + virt_systemctl($1) + allow $1 virtd_unit_file_t:service all_service_perms; -- logging_search_logs($1) -- admin_pattern($1, virt_log_t) +- files_search_var($1) +- admin_pattern($1, svirt_cache_t) + virt_stream_connect_sandbox($1) + virt_stream_connect_svirt($1) + virt_stream_connect($1) @@ -110302,32 +110425,9 @@ index facdee8..eae2073 100644 + attribute sandbox_caps_domain; + ') -- files_search_pids($1) -- admin_pattern($1, { virt_var_run_t virtd_lxc_var_run_t svirt_var_run_t }) -+ typeattribute $1 sandbox_caps_domain; -+') - -- files_search_var($1) -- admin_pattern($1, svirt_cache_t) -+######################################## -+## -+## Allow the domain to read svirt_sandbox_domain state files in /proc. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`virt_sandbox_read_state',` -+ gen_require(` -+ attribute svirt_sandbox_domain; -+ ') - - files_search_var_lib($1) - admin_pattern($1, { virt_image_type virt_var_lib_t svirt_lxc_file_t }) -+ kernel_search_proc($1) -+ ps_process_pattern($1, svirt_sandbox_domain) ++ typeattribute $1 sandbox_caps_domain; +') - files_search_locks($1) diff --git a/selinux-policy.spec b/selinux-policy.spec index bd184dd..3520814 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 158%{?dist} +Release: 159%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -664,6 +664,22 @@ exit 0 %endif %changelog +* Fri Nov 20 2015 Miroslav Grepl 3.13.1-159 +- Allow antivirus_t to bind to all unreserved ports. Clamd binds to random unassigned port (by default in range 1024-2048) +- Allow abrt-hook-ccpp to change SELinux user identity for created objects. +- Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern. +- Allow setuid/setgid capabilities for abrt-hook-ccpp. +- Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.conf. +- Allow fenced node dbus msg when using foghorn witch configured foghorn, snmpd, and snmptrapd. +- cockpit has grown content in /var/run directory +- Add support for /dev/mptctl device used to check RAID status. +- Allow systemd-hostnamed to communicate with dhcp via dbus. +- systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments. +- Add userdom_destroy_unpriv_user_shared_mem() interface. +- Label /var/run/systemd/shutdown directory as systemd_logind_var_run_t to allow systemd-logind to access it if shutdown is invoked. +- Access needed by systemd-machine to manage docker containers +- Allow systemd-logind to read /run/utmp when shutdown is invoked. + * Tue Nov 10 2015 Miroslav Grepl 3.13.1-158 - Merge pull request #48 from lkundrak/contrib-openfortivpn - unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets.