From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3A42C433E6 for ; Tue, 2 Feb 2021 14:56:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 842D064F6A for ; Tue, 2 Feb 2021 14:56:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234059AbhBBO4e (ORCPT ); Tue, 2 Feb 2021 09:56:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33192 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234752AbhBBO4Y (ORCPT ); Tue, 2 Feb 2021 09:56:24 -0500 Received: from smtp.sws.net.au (smtp.sws.net.au [IPv6:2a01:4f8:140:71f5::dada:cafe]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 62A6FC061573 for ; Tue, 2 Feb 2021 06:55:44 -0800 (PST) Received: from xev.coker.com.au (localhost [127.0.0.1]) by smtp.sws.net.au (Postfix) with ESMTP id 7AEA9F05D for ; Wed, 3 Feb 2021 01:55:42 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1612277742; bh=D53G0ZZ1tZXATnmr6WaYzpyPCxaY+Hcjh6YP3NsD2IA=; l=6116; h=Date:From:To:Subject:From; b=aVYP0n69iNDuR0Ooa9W0xEmFDYzP12z8kuabzXNp7CeRgmUaWWLxqVPS0Kg4bM9vX kqfoW4//khSoDy+z02+6z3xtJypjC1zMg/i9iN7MyJqqUe7H60e62+b8LU3mflomoj gYR3rsZAmAlbjnlXR89BG5PYpUHywrHVcE3MGmJs= Received: by xev.coker.com.au (Postfix, from userid 1001) id 2447C1353569; Wed, 3 Feb 2021 01:55:38 +1100 (AEDT) Date: Wed, 3 Feb 2021 01:55:38 +1100 From: Russell Coker To: selinux-refpolicy@vger.kernel.org Subject: [PATCH] misc apps and admin patches Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org Send again without the section Dominick didn't like. I think it's ready for inclusion. Signed-off-by: Russell Coker Index: refpolicy-2.20210126/policy/modules/admin/apt.fc =================================================================== --- refpolicy-2.20210126.orig/policy/modules/admin/apt.fc +++ refpolicy-2.20210126/policy/modules/admin/apt.fc @@ -5,6 +5,8 @@ /usr/bin/apt-shell -- gen_context(system_u:object_r:apt_exec_t,s0) /usr/bin/aptitude -- gen_context(system_u:object_r:apt_exec_t,s0) /usr/sbin/update-apt-xapian-index -- gen_context(system_u:object_r:apt_exec_t,s0) +/usr/share/unattended-upgrades/unattended-upgrade-shutdown -- gen_context(system_u:object_r:apt_exec_t,s0) +/usr/bin/unattended-upgrade -- gen_context(system_u:object_r:apt_exec_t,s0) ifndef(`distro_redhat',` /usr/sbin/synaptic -- gen_context(system_u:object_r:apt_exec_t,s0) @@ -23,5 +25,5 @@ ifndef(`distro_redhat',` /var/lock/aptitude gen_context(system_u:object_r:apt_lock_t,s0) /var/log/aptitude.* gen_context(system_u:object_r:apt_var_log_t,s0) - +/var/log/unattended-upgrades(/.*) gen_context(system_u:object_r:apt_var_log_t,s0) /var/log/apt(/.*)? gen_context(system_u:object_r:apt_var_log_t,s0) Index: refpolicy-2.20210126/policy/modules/admin/apt.te =================================================================== --- refpolicy-2.20210126.orig/policy/modules/admin/apt.te +++ refpolicy-2.20210126/policy/modules/admin/apt.te @@ -155,6 +155,10 @@ optional_policy(` ') optional_policy(` + networkmanager_dbus_chat(apt_t) +') + +optional_policy(` nis_use_ypbind(apt_t) ') @@ -169,5 +173,9 @@ optional_policy(` ') optional_policy(` + systemd_dbus_chat_logind(apt_t) +') + +optional_policy(` unconfined_domain(apt_t) ') Index: refpolicy-2.20210126/policy/modules/admin/bootloader.te =================================================================== --- refpolicy-2.20210126.orig/policy/modules/admin/bootloader.te +++ refpolicy-2.20210126/policy/modules/admin/bootloader.te @@ -186,6 +186,9 @@ ifdef(`distro_debian',` dpkg_read_db(bootloader_t) dpkg_rw_pipes(bootloader_t) + + apt_use_fds(bootloader_t) + apt_use_ptys(bootloader_t) ') ifdef(`distro_redhat',` Index: refpolicy-2.20210126/policy/modules/admin/logrotate.te =================================================================== --- refpolicy-2.20210126.orig/policy/modules/admin/logrotate.te +++ refpolicy-2.20210126/policy/modules/admin/logrotate.te @@ -121,6 +121,7 @@ logging_send_syslog_msg(logrotate_t) logging_send_audit_msgs(logrotate_t) logging_exec_all_logs(logrotate_t) +miscfiles_read_generic_certs(logrotate_t) miscfiles_read_localization(logrotate_t) seutil_dontaudit_read_config(logrotate_t) @@ -242,6 +243,7 @@ optional_policy(` ') optional_policy(` + samba_domtrans_smbcontrol(logrotate_t) samba_exec_log(logrotate_t) ') Index: refpolicy-2.20210126/policy/modules/apps/games.te =================================================================== --- refpolicy-2.20210126.orig/policy/modules/apps/games.te +++ refpolicy-2.20210126/policy/modules/apps/games.te @@ -111,9 +111,11 @@ fs_tmpfs_filetrans(games_t, games_tmpfs_ can_exec(games_t, games_exec_t) +kernel_read_kernel_sysctls(games_t) kernel_read_system_state(games_t) corecmd_exec_bin(games_t) +corecmd_exec_shell(games_t) corenet_all_recvfrom_netlabel(games_t) corenet_tcp_sendrecv_generic_if(games_t) @@ -146,6 +148,7 @@ init_dontaudit_rw_utmp(games_t) logging_dontaudit_search_logs(games_t) +miscfiles_read_generic_certs(games_t) miscfiles_read_man_pages(games_t) miscfiles_read_localization(games_t) @@ -162,8 +165,14 @@ tunable_policy(`allow_execmem',` ') optional_policy(` + alsa_read_config(games_t) +') + +optional_policy(` dbus_all_session_bus_client(games_t) dbus_connect_all_session_bus(games_t) + dbus_read_lib_files(games_t) + dbus_system_bus_client(games_t) ') optional_policy(` @@ -175,6 +184,11 @@ optional_policy(` ') optional_policy(` + xdg_read_config_files(games_t) + xdg_read_data_files(games_t) +') + +optional_policy(` xserver_user_x_domain_template(games, games_t, games_tmpfs_t) xserver_create_xdm_tmp_sockets(games_t) xserver_read_xdm_lib_files(games_t) Index: refpolicy-2.20210126/policy/modules/apps/mplayer.if =================================================================== --- refpolicy-2.20210126.orig/policy/modules/apps/mplayer.if +++ refpolicy-2.20210126/policy/modules/apps/mplayer.if @@ -38,7 +38,7 @@ interface(`mplayer_role',` domtrans_pattern($2, mencoder_exec_t, mencoder_t) domtrans_pattern($2, mplayer_exec_t, mplayer_t) - allow $2 { mplayer_t mencoder_t }:process { ptrace signal_perms }; + allow $2 { mplayer_t mencoder_t }:process { getsched ptrace signal_perms }; ps_process_pattern($2, { mplayer_t mencoder_t }) allow $2 mplayer_home_t:dir { manage_dir_perms relabel_dir_perms }; Index: refpolicy-2.20210126/policy/modules/apps/mplayer.te =================================================================== --- refpolicy-2.20210126.orig/policy/modules/apps/mplayer.te +++ refpolicy-2.20210126/policy/modules/apps/mplayer.te @@ -119,12 +119,16 @@ tunable_policy(`use_samba_home_dirs',` fs_manage_cifs_symlinks(mencoder_t) ') +tunable_policy(`xserver_allow_dri',` + dev_rw_dri(mplayer_t) +') + ######################################## # # Mplayer local policy # -allow mplayer_t self:process { signal_perms getsched }; +allow mplayer_t self:process { signal_perms getsched setsched }; allow mplayer_t self:fifo_file rw_fifo_file_perms; allow mplayer_t self:sem create_sem_perms; allow mplayer_t self:udp_socket create_socket_perms; @@ -147,6 +151,7 @@ fs_tmpfs_filetrans(mplayer_t, mplayer_tm kernel_dontaudit_list_unlabeled(mplayer_t) kernel_dontaudit_getattr_unlabeled_files(mplayer_t) kernel_dontaudit_read_unlabeled_files(mplayer_t) +kernel_read_crypto_sysctls(mplayer_t) kernel_read_system_state(mplayer_t) kernel_read_kernel_sysctls(mplayer_t)