* [PATCH 0/1][meta-selinux][V2] refpolicy: make proftpd be able to work
@ 2014-02-14 6:10 rongqing.li
2014-02-14 6:10 ` [PATCH 1/1] " rongqing.li
2014-04-03 19:05 ` [PATCH 0/1][meta-selinux][V2] " Joe MacDonald
0 siblings, 2 replies; 3+ messages in thread
From: rongqing.li @ 2014-02-14 6:10 UTC (permalink / raw)
To: yocto
From: Roy Li <rongqing.li@windriver.com>
The following changes since commit a6079a43719e79e12a57e609923a0cccdba06916:
refpolicy: fix real path for su.shadow (2014-02-13 10:52:07 -0500)
are available in the git repository at:
git://git.pokylinux.org/poky-contrib roy/proftpd-1
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=roy/proftpd-1
Roy Li (1):
refpolicy: make proftpd be able to work
.../ftp-add-ftpd_t-to-mlsfilewrite.patch | 39 ++++++++++++++++++++
.../refpolicy/refpolicy_2.20130424.inc | 1 +
2 files changed, 40 insertions(+)
create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/ftp-add-ftpd_t-to-mlsfilewrite.patch
--
1.7.10.4
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 1/1] refpolicy: make proftpd be able to work
2014-02-14 6:10 [PATCH 0/1][meta-selinux][V2] refpolicy: make proftpd be able to work rongqing.li
@ 2014-02-14 6:10 ` rongqing.li
2014-04-03 19:05 ` [PATCH 0/1][meta-selinux][V2] " Joe MacDonald
1 sibling, 0 replies; 3+ messages in thread
From: rongqing.li @ 2014-02-14 6:10 UTC (permalink / raw)
To: yocto
From: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
---
.../ftp-add-ftpd_t-to-mlsfilewrite.patch | 39 ++++++++++++++++++++
.../refpolicy/refpolicy_2.20130424.inc | 1 +
2 files changed, 40 insertions(+)
create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/ftp-add-ftpd_t-to-mlsfilewrite.patch
diff --git a/recipes-security/refpolicy/refpolicy-2.20130424/ftp-add-ftpd_t-to-mlsfilewrite.patch b/recipes-security/refpolicy/refpolicy-2.20130424/ftp-add-ftpd_t-to-mlsfilewrite.patch
new file mode 100644
index 0000000..49da4b6
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20130424/ftp-add-ftpd_t-to-mlsfilewrite.patch
@@ -0,0 +1,39 @@
+From e4e95b723d31c7b678a05cd81a96b10185978b4e Mon Sep 17 00:00:00 2001
+From: Roy Li <rongqing.li@windriver.com>
+Date: Mon, 10 Feb 2014 18:10:12 +0800
+Subject: [PATCH] ftp: add ftpd_t to mls_file_write_all_levels
+
+Proftpd will create file under /var/run, but its mls is in high, and
+can not write to lowlevel
+
+Upstream-Status: Pending
+
+type=AVC msg=audit(1392347709.621:15): avc: denied { write } for pid=545 comm="proftpd" name="/" dev="tmpfs" ino=5853 scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir
+type=AVC msg=audit(1392347709.621:15): avc: denied { add_name } for pid=545 comm="proftpd" name="proftpd.delay" scontext=system_u:system_r:ftpd_t:s15:c0.c1023 tcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 tclass=dir
+type=SYSCALL msg=audit(1392347709.621:15): arch=c000003e syscall=2 success=yes exit=3 a0=471910 a1=42 a2=1b6 a3=8 items=0 ppid=539 pid=545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="proftpd" exe="/usr/sbin/proftpd" subj=system_u:system_r:ftpd_t:s15:c0.c1023 key=(null)
+
+root@localhost:~# sesearch --allow -s ftpd_t -t var_run_t|grep dir|grep add_name
+ allow ftpd_t var_run_t : dir { ioctl read write getattr lock add_name remove_name search open } ;
+root@localhost:~#
+
+Signed-off-by: Roy Li <rongqing.li@windriver.com>
+---
+ policy/modules/contrib/ftp.te | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/policy/modules/contrib/ftp.te b/policy/modules/contrib/ftp.te
+index 544c512..12a31dd 100644
+--- a/policy/modules/contrib/ftp.te
++++ b/policy/modules/contrib/ftp.te
+@@ -144,6 +144,8 @@ role ftpdctl_roles types ftpdctl_t;
+ type ftpdctl_tmp_t;
+ files_tmp_file(ftpdctl_tmp_t)
+
++mls_file_write_all_levels(ftpd_t)
++
+ type sftpd_t;
+ domain_type(sftpd_t)
+ role system_r types sftpd_t;
+--
+1.7.10.4
+
diff --git a/recipes-security/refpolicy/refpolicy_2.20130424.inc b/recipes-security/refpolicy/refpolicy_2.20130424.inc
index 9e5e426..24c0608 100644
--- a/recipes-security/refpolicy/refpolicy_2.20130424.inc
+++ b/recipes-security/refpolicy/refpolicy_2.20130424.inc
@@ -54,6 +54,7 @@ SRC_URI += "file://poky-policy-fix-xconsole_device_t-as-a-dev_node.patch \
file://poky-policy-fix-dmesg-to-use-dev-kmsg.patch \
file://hostname-do-not-audit-attempts-by-hostname-to-read-a.patch \
file://sysnetwork-dhcpc-binds-socket-to-random-high-udp-por.patch \
+ file://ftp-add-ftpd_t-to-mlsfilewrite.patch \
"
# Backport from upstream
--
1.7.10.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 0/1][meta-selinux][V2] refpolicy: make proftpd be able to work
2014-02-14 6:10 [PATCH 0/1][meta-selinux][V2] refpolicy: make proftpd be able to work rongqing.li
2014-02-14 6:10 ` [PATCH 1/1] " rongqing.li
@ 2014-04-03 19:05 ` Joe MacDonald
1 sibling, 0 replies; 3+ messages in thread
From: Joe MacDonald @ 2014-04-03 19:05 UTC (permalink / raw)
To: rongqing.li; +Cc: yocto
[-- Attachment #1: Type: text/plain, Size: 940 bytes --]
Merged, thanks.
-J.
[[yocto] [PATCH 0/1][meta-selinux][V2] refpolicy: make proftpd be able to work] On 14.02.14 (Fri 14:10) rongqing.li@windriver.com wrote:
> From: Roy Li <rongqing.li@windriver.com>
>
> The following changes since commit a6079a43719e79e12a57e609923a0cccdba06916:
>
> refpolicy: fix real path for su.shadow (2014-02-13 10:52:07 -0500)
>
> are available in the git repository at:
>
> git://git.pokylinux.org/poky-contrib roy/proftpd-1
> http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=roy/proftpd-1
>
> Roy Li (1):
> refpolicy: make proftpd be able to work
>
> .../ftp-add-ftpd_t-to-mlsfilewrite.patch | 39 ++++++++++++++++++++
> .../refpolicy/refpolicy_2.20130424.inc | 1 +
> 2 files changed, 40 insertions(+)
> create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/ftp-add-ftpd_t-to-mlsfilewrite.patch
>
--
-Joe MacDonald.
:wq
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 205 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-04-03 19:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-02-14 6:10 [PATCH 0/1][meta-selinux][V2] refpolicy: make proftpd be able to work rongqing.li
2014-02-14 6:10 ` [PATCH 1/1] " rongqing.li
2014-04-03 19:05 ` [PATCH 0/1][meta-selinux][V2] " Joe MacDonald
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.