File fix_unconfinedprivs.patch of Package selinux-policy

Overview Repositories Revisions Requests Users Attributes Meta

File fix_unconfinedprivs.patch of Package selinux-policy (Revision c30ca4576a5a4ec14426022d9b8f16e7)

Currently displaying revision c30ca4576a5a4ec14426022d9b8f16e7 , Show latest

diff --git a/config/appconfig-mcs/default_contexts b/config/appconfig-mcs/default_contexts
index 698d54ce8..0c9a01823 100644
--- a/config/appconfig-mcs/default_contexts
+++ b/config/appconfig-mcs/default_contexts
@@ -13,3 +13,5 @@ sysadm_r:sysadm_sudo_t:s0	sysadm_r:sysadm_t:s0
 
 user_r:user_su_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 user_r:user_sudo_t:s0		sysadm_r:sysadm_t:s0 user_r:user_t:s0
+
+unconfined_r:unconfined_t:s0	system_r:sysadm_t:s0
diff --git a/policy/mcs b/policy/mcs
index ba9e2ee16..d5cee4819 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -71,13 +71,13 @@ gen_levels(1,mcs_num_cats)
 #  - /proc/pid operations are not constrained.
 
 mlsconstrain file { read ioctl lock execute execute_no_trans }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom l2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain file { write setattr append unlink link rename }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain dir { search read ioctl lock }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom l2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain dir { write setattr append unlink link rename add_name remove_name }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
@@ -86,7 +86,7 @@ mlsconstrain fifo_file { open }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain { lnk_file chr_file blk_file sock_file } { getattr read ioctl }
-	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+	(( h1 dom l2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain { lnk_file chr_file blk_file sock_file } { write setattr }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
index 0e843721b..fdd5f7ec2 100644
--- a/policy/modules/kernel/domain.if
+++ b/policy/modules/kernel/domain.if
@@ -1692,8 +1692,6 @@ interface(`domain_unconfined',`
 	typeattribute $1 process_uncond_exempt;
 
 	mcs_process_set_categories($1)
-
-	userdom_filetrans_home_content($1)
 ')
 
 ########################################
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
index f1e0bd689..d40366e16 100644
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -316,42 +316,6 @@ optional_policy(`
     kdump_filetrans_named_content(unconfined_domain_type)
 ')
 
-optional_policy(`
-    fstools_filetrans_named_content_fsadm(named_filetrans_domain)
-')
-
-optional_policy(`
-    ipa_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	locallogin_filetrans_home_content(named_filetrans_domain)
-')
-
-optional_policy(`
-    mandb_filetrans_named_home_content(named_filetrans_domain)
-')
-
-optional_policy(`
-    ppp_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	snapper_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	seutil_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	wine_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-    storage_filetrans_all_named_dev(named_filetrans_domain)
-')
-
 term_filetrans_all_named_dev(named_filetrans_domain)
 
 optional_policy(`
@@ -380,143 +344,6 @@ optional_policy(`
 	libs_filetrans_named_content(unconfined_domain_type)
 ')
 
-optional_policy(`
-	auth_filetrans_named_content(named_filetrans_domain)
-	auth_filetrans_admin_home_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	libs_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	logging_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	miscfiles_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	abrt_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	alsa_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	apache_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-    apcupsd_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	bootloader_filetrans_config(named_filetrans_domain)
-')
-
-optional_policy(`
-	clock_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	cups_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	cvs_filetrans_home_content(named_filetrans_domain)
-')
-
-optional_policy(`
-    dbus_filetrans_named_content_system(named_filetrans_domain)
-')
-
-optional_policy(`
-	devicekit_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	dnsmasq_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	gnome_filetrans_admin_home_content(named_filetrans_domain)
-')
-
-optional_policy(`
-    iscsi_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-    iptables_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	kerberos_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	mta_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-    mplayer_filetrans_home_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	modules_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	mysql_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	networkmanager_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	ntp_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	nx_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	plymouthd_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	postgresql_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	postfix_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	prelink_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	pulseaudio_filetrans_admin_home_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	quota_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	rpcbind_filetrans_named_content(named_filetrans_domain)
-')
-
-optional_policy(`
-	rsync_filetrans_named_content(named_filetrans_domain)
-')
-
 optional_policy(`
 	sysnet_filetrans_named_content(named_filetrans_domain)
 	sysnet_filetrans_named_content_ifconfig(named_filetrans_domain)
@@ -533,7 +360,6 @@ optional_policy(`
 	systemd_resolved_write_pid_sock_files(domain)
 	systemd_filetrans_named_content(named_filetrans_domain)
 	systemd_filetrans_named_hostname(named_filetrans_domain)
-	systemd_filetrans_home_content(named_filetrans_domain)
 	systemd_dontaudit_write_inherited_logind_sessions_pipes(domain)
 ')
 
@@ -546,18 +372,9 @@ optional_policy(`
 ')
 
 optional_policy(`
-	userdom_user_home_dir_filetrans_user_home_content(named_filetrans_domain, { dir file lnk_file fifo_file sock_file })
-')
-
-optional_policy(`
-	ssh_filetrans_admin_home_content(named_filetrans_domain)
 	ssh_filetrans_keys(unconfined_domain_type)
 ')
 
-optional_policy(`
-    userdom_filetrans_named_user_tmp_files(named_filetrans_domain)
-')
-
 optional_policy(`
 	virt_filetrans_named_content(named_filetrans_domain)
 ')
diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te
index 3221f8018..a2cc7db61 100644
--- a/policy/modules/kernel/files.te
+++ b/policy/modules/kernel/files.te
@@ -248,9 +248,16 @@ fs_associate_tmpfs(tmpfsfile)
 #
 
 # Create/access any file in a labeled filesystem;
-allow files_unconfined_type file_type:{ file chr_file } ~{ execmod entrypoint };
-allow files_unconfined_type file_type:{ dir lnk_file sock_file fifo_file blk_file } *;
-allow files_unconfined_type file_type:service *;
+define(`unconfined_file_type',`{ base_file_type pidfile -base_ro_file_type -polyparent -security_file_type -auth_file_type }')
+define(`unconfined_ro_file_type',`{ base_ro_file_type non_auth_file_type -pidfile -polyparent }')
+
+allow files_unconfined_type unconfined_file_type:file_class_set manage_file_perms;
+allow files_unconfined_type unconfined_file_type:dir manage_dir_perms;
+allow files_unconfined_type unconfined_file_type:service { status reload };
+
+allow files_unconfined_type unconfined_ro_file_type:file_class_set mmap_read_file_perms;
+allow files_unconfined_type unconfined_ro_file_type:dir list_dir_perms;
+allow files_unconfined_type unconfined_ro_file_type:service status;
 
 # Mount/unmount any filesystem with the context= option.
 allow files_unconfined_type file_type:filesystem all_filesystem_perms;
diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index 329eb6d2c..bbe5786aa 100644
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -363,5 +363,5 @@ allow filesystem_unconfined_type filesystem_type:filesystem all_filesystem_perms
 # Create/access other files. fs_type is to pick up various
 # pseudo filesystem types that are applied to both the filesystem
 # and its files.
-allow filesystem_unconfined_type filesystem_type:{ file } ~entrypoint;
-allow filesystem_unconfined_type filesystem_type:{ dir lnk_file sock_file fifo_file chr_file blk_file } *;
+allow filesystem_unconfined_type filesystem_type:{ file dir lnk_file sock_file fifo_file chr_file blk_file } { getattr ioctl lock open read };
+allow filesystem_unconfined_type filesystem_type:{ dir } { search watch };
diff --git a/policy/modules/kernel/selinux.te b/policy/modules/kernel/selinux.te
index 7d3e431ee..01dec0ff1 100644
--- a/policy/modules/kernel/selinux.te
+++ b/policy/modules/kernel/selinux.te
@@ -61,28 +61,28 @@ ifdef(`distro_rhel4',`
 ')
 
 if(!secure_mode_policyload) {
-	allow can_setenforce security_t:security setenforce;
-	dev_getattr_sysfs_fs(can_setenforce)
-	dev_search_sysfs(can_setenforce)
-	allow can_setenforce security_t:dir list_dir_perms;
-	allow can_setenforce security_t:file rw_file_perms;
+	allow { can_setenforce -selinux_unconfined_type } security_t:security setenforce;
+	dev_getattr_sysfs_fs({ can_setenforce -selinux_unconfined_type })
+	dev_search_sysfs({ can_setenforce -selinux_unconfined_type })
+	allow { can_setenforce -selinux_unconfined_type } security_t:dir list_dir_perms;
+	allow { can_setenforce -selinux_unconfined_type } security_t:file rw_file_perms;
 
 	ifdef(`distro_rhel4',`
 		# needed for systems without audit support
-		auditallow can_setenforce security_t:security setenforce;
+		auditallow { can_setenforce -selinux_unconfined_type } security_t:security setenforce;
 	')
 
-	allow can_load_policy security_t:security load_policy;
+	allow { can_load_policy -selinux_unconfined_type } security_t:security load_policy;
 
 	ifdef(`distro_rhel4',`
 		# needed for systems without audit support
-		auditallow can_load_policy security_t:security load_policy;
+		auditallow { can_load_policy -selinux_unconfined_type } security_t:security load_policy;
 	')
 
-	allow can_setbool boolean_type:security setbool;
+	allow { can_setbool -selinux_unconfined_type } boolean_type:security setbool;
 
 	ifdef(`distro_rhel4',`
 		# needed for systems without audit support
-		auditallow can_setbool boolean_type:security setbool;
+		auditallow { can_setbool -selinux_unconfined_type } boolean_type:security setbool;
 	')
 }
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 4e9744c29..2eb4d5ad9 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -3585,26 +3585,6 @@ interface(`userdom_manage_user_tmp_files',`
 	files_search_tmp($1)
 ')
 
-########################################
-## <summary>
-##	Create, read, write, and delete user
-##	temporary files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`userdom_filetrans_named_user_tmp_files',`
-	gen_require(`
-		type user_tmp_t;
-	')
-
-    files_tmp_filetrans($1, user_tmp_t, dir, "hsperfdata_root")
-	files_search_tmp($1)
-')
-
 ########################################
 ## <summary>
 ##	Create, read, write, and delete user

Places

File fix_unconfinedprivs.patch of Package selinux-policy (Revision c30ca4576a5a4ec14426022d9b8f16e7)

Places