From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 745D1C433E0 for ; Tue, 2 Feb 2021 19:12:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4479664E45 for ; Tue, 2 Feb 2021 19:12:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237886AbhBBTL5 (ORCPT ); Tue, 2 Feb 2021 14:11:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59126 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239526AbhBBTGu (ORCPT ); Tue, 2 Feb 2021 14:06:50 -0500 Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D1256C061351 for ; Tue, 2 Feb 2021 11:03:39 -0800 (PST) Received: by mail-qk1-x729.google.com with SMTP id k193so20881490qke.6 for ; Tue, 02 Feb 2021 11:03:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=enMLssKRjlRIT+rSXrPmYWwPIjI6iU8zv0W/EX3dbmk=; b=dp2Mng3eVXlZph8Fn5zFo2L5+KUWDfFTbvgdjnTyoD+gljLzP0AFV/1SX9zlFVwhFe DNrl6vyLIYQXf2q5+mBDs5OFnRhKBlSYbo0WE8c7FpOAYXFRKEXSYw02ZqxVbANst2E4 4adI3KFnjV2EhBMt0Ay9nOaTVSANrNDPfWthg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=enMLssKRjlRIT+rSXrPmYWwPIjI6iU8zv0W/EX3dbmk=; b=LbcK7O0zzT5hBkhGBrmw6EQgTKrIIVxH/7u+0c6a3iV2Dr9PIzcNejHWQqJbokYD/Q 7b7GqgVcF4hPwHrs7J5tYZEbxVSuK7GSFjNo8NgR/Fq4UhPGvduAKQYGgdykKpazNtQd N+Xnks/ia+v7tVA6jBxh29ywSt6YTZzLMoNr3rIs+jefgDVRfbAfvgUHXc2UfyOIr2Jb 0EGMo/3LrQSdNHu9JZlTxuqFS+QbDzApAFnjJnkHgV4YVd9hpjh1JGLQY2+POFUISlCk X9m0ZjVJ6KG18RWkvsns7iLQvxxXYztHn9Pa8QJCMDLGr+3WdekSI6ypjgk27m9DfYmE xWGg== X-Gm-Message-State: AOAM5332KQE0gf8uWGwBgjB6Z9bZKZaUfb/39+rVjwggStdusM42k93S sEvCi7XOoc7djqPb20TNj1AhYu8crtplkw== X-Google-Smtp-Source: ABdhPJwSw8uew3VR9a9Ag7pgGwpTZlVjdhV+H6ZUInLRivW/hz6zhxoJGua/a7527Zl9wakhWJ+pug== X-Received: by 2002:a37:678b:: with SMTP id b133mr22508115qkc.237.1612292618737; Tue, 02 Feb 2021 11:03:38 -0800 (PST) Received: from fedora.pebenito.net (pool-96-234-173-17.bltmmd.fios.verizon.net. [96.234.173.17]) by smtp.gmail.com with ESMTPSA id t184sm18207688qkd.100.2021.02.02.11.03.38 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 02 Feb 2021 11:03:38 -0800 (PST) Subject: Re: [PATCH] misc apps and admin patches To: Russell Coker , selinux-refpolicy@vger.kernel.org References: From: Chris PeBenito Message-ID: Date: Tue, 2 Feb 2021 13:33:20 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org On 2/2/21 9:55 AM, Russell Coker wrote: > Send again without the section Dominick didn't like. I think it's ready for inclusion. > > Signed-off-by: Russell Coker > > Index: refpolicy-2.20210126/policy/modules/admin/apt.fc > =================================================================== > --- refpolicy-2.20210126.orig/policy/modules/admin/apt.fc > +++ refpolicy-2.20210126/policy/modules/admin/apt.fc > @@ -5,6 +5,8 @@ > /usr/bin/apt-shell -- gen_context(system_u:object_r:apt_exec_t,s0) > /usr/bin/aptitude -- gen_context(system_u:object_r:apt_exec_t,s0) > /usr/sbin/update-apt-xapian-index -- gen_context(system_u:object_r:apt_exec_t,s0) > +/usr/share/unattended-upgrades/unattended-upgrade-shutdown -- gen_context(system_u:object_r:apt_exec_t,s0) > +/usr/bin/unattended-upgrade -- gen_context(system_u:object_r:apt_exec_t,s0) > > ifndef(`distro_redhat',` > /usr/sbin/synaptic -- gen_context(system_u:object_r:apt_exec_t,s0) > @@ -23,5 +25,5 @@ ifndef(`distro_redhat',` > /var/lock/aptitude gen_context(system_u:object_r:apt_lock_t,s0) > > /var/log/aptitude.* gen_context(system_u:object_r:apt_var_log_t,s0) > - > +/var/log/unattended-upgrades(/.*) gen_context(system_u:object_r:apt_var_log_t,s0) > /var/log/apt(/.*)? gen_context(system_u:object_r:apt_var_log_t,s0) > Index: refpolicy-2.20210126/policy/modules/admin/apt.te > =================================================================== > --- refpolicy-2.20210126.orig/policy/modules/admin/apt.te > +++ refpolicy-2.20210126/policy/modules/admin/apt.te > @@ -155,6 +155,10 @@ optional_policy(` > ') > > optional_policy(` > + networkmanager_dbus_chat(apt_t) > +') > + > +optional_policy(` > nis_use_ypbind(apt_t) > ') > > @@ -169,5 +173,9 @@ optional_policy(` > ') > > optional_policy(` > + systemd_dbus_chat_logind(apt_t) > +') > + > +optional_policy(` > unconfined_domain(apt_t) > ') > Index: refpolicy-2.20210126/policy/modules/admin/bootloader.te > =================================================================== > --- refpolicy-2.20210126.orig/policy/modules/admin/bootloader.te > +++ refpolicy-2.20210126/policy/modules/admin/bootloader.te > @@ -186,6 +186,9 @@ ifdef(`distro_debian',` > > dpkg_read_db(bootloader_t) > dpkg_rw_pipes(bootloader_t) > + > + apt_use_fds(bootloader_t) > + apt_use_ptys(bootloader_t) > ') > > ifdef(`distro_redhat',` > Index: refpolicy-2.20210126/policy/modules/admin/logrotate.te > =================================================================== > --- refpolicy-2.20210126.orig/policy/modules/admin/logrotate.te > +++ refpolicy-2.20210126/policy/modules/admin/logrotate.te > @@ -121,6 +121,7 @@ logging_send_syslog_msg(logrotate_t) > logging_send_audit_msgs(logrotate_t) > logging_exec_all_logs(logrotate_t) > > +miscfiles_read_generic_certs(logrotate_t) > miscfiles_read_localization(logrotate_t) > > seutil_dontaudit_read_config(logrotate_t) > @@ -242,6 +243,7 @@ optional_policy(` > ') > > optional_policy(` > + samba_domtrans_smbcontrol(logrotate_t) > samba_exec_log(logrotate_t) > ') > > Index: refpolicy-2.20210126/policy/modules/apps/games.te > =================================================================== > --- refpolicy-2.20210126.orig/policy/modules/apps/games.te > +++ refpolicy-2.20210126/policy/modules/apps/games.te > @@ -111,9 +111,11 @@ fs_tmpfs_filetrans(games_t, games_tmpfs_ > > can_exec(games_t, games_exec_t) > > +kernel_read_kernel_sysctls(games_t) > kernel_read_system_state(games_t) > > corecmd_exec_bin(games_t) > +corecmd_exec_shell(games_t) > > corenet_all_recvfrom_netlabel(games_t) > corenet_tcp_sendrecv_generic_if(games_t) > @@ -146,6 +148,7 @@ init_dontaudit_rw_utmp(games_t) > > logging_dontaudit_search_logs(games_t) > > +miscfiles_read_generic_certs(games_t) > miscfiles_read_man_pages(games_t) > miscfiles_read_localization(games_t) > > @@ -162,8 +165,14 @@ tunable_policy(`allow_execmem',` > ') > > optional_policy(` > + alsa_read_config(games_t) > +') > + > +optional_policy(` > dbus_all_session_bus_client(games_t) > dbus_connect_all_session_bus(games_t) > + dbus_read_lib_files(games_t) > + dbus_system_bus_client(games_t) > ') > > optional_policy(` > @@ -175,6 +184,11 @@ optional_policy(` > ') > > optional_policy(` > + xdg_read_config_files(games_t) > + xdg_read_data_files(games_t) > +') > + > +optional_policy(` > xserver_user_x_domain_template(games, games_t, games_tmpfs_t) > xserver_create_xdm_tmp_sockets(games_t) > xserver_read_xdm_lib_files(games_t) > Index: refpolicy-2.20210126/policy/modules/apps/mplayer.if > =================================================================== > --- refpolicy-2.20210126.orig/policy/modules/apps/mplayer.if > +++ refpolicy-2.20210126/policy/modules/apps/mplayer.if > @@ -38,7 +38,7 @@ interface(`mplayer_role',` > domtrans_pattern($2, mencoder_exec_t, mencoder_t) > domtrans_pattern($2, mplayer_exec_t, mplayer_t) > > - allow $2 { mplayer_t mencoder_t }:process { ptrace signal_perms }; > + allow $2 { mplayer_t mencoder_t }:process { getsched ptrace signal_perms }; > ps_process_pattern($2, { mplayer_t mencoder_t }) > > allow $2 mplayer_home_t:dir { manage_dir_perms relabel_dir_perms }; > Index: refpolicy-2.20210126/policy/modules/apps/mplayer.te > =================================================================== > --- refpolicy-2.20210126.orig/policy/modules/apps/mplayer.te > +++ refpolicy-2.20210126/policy/modules/apps/mplayer.te > @@ -119,12 +119,16 @@ tunable_policy(`use_samba_home_dirs',` > fs_manage_cifs_symlinks(mencoder_t) > ') > > +tunable_policy(`xserver_allow_dri',` > + dev_rw_dri(mplayer_t) > +') > + > ######################################## > # > # Mplayer local policy > # > > -allow mplayer_t self:process { signal_perms getsched }; > +allow mplayer_t self:process { signal_perms getsched setsched }; > allow mplayer_t self:fifo_file rw_fifo_file_perms; > allow mplayer_t self:sem create_sem_perms; > allow mplayer_t self:udp_socket create_socket_perms; > @@ -147,6 +151,7 @@ fs_tmpfs_filetrans(mplayer_t, mplayer_tm > kernel_dontaudit_list_unlabeled(mplayer_t) > kernel_dontaudit_getattr_unlabeled_files(mplayer_t) > kernel_dontaudit_read_unlabeled_files(mplayer_t) > +kernel_read_crypto_sysctls(mplayer_t) > kernel_read_system_state(mplayer_t) > kernel_read_kernel_sysctls(mplayer_t) Merged. Some lines were moved. -- Chris PeBenito