Gentoo Archives: gentoo-commits

From: Jason Zaman <perfinion@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/system/
Date: Mon, 03 Oct 2016 06:26:39
Message-Id: 1475474661.c7941d5608f8aadd8be1cdda6abff4084b2e094e.perfinion@gentoo
1 commit: c7941d5608f8aadd8be1cdda6abff4084b2e094e
2 Author: Jason Zaman via refpolicy <refpolicy <AT> oss <DOT> tresys <DOT> com>
3 AuthorDate: Sun Sep 18 06:38:31 2016 +0000
4 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
5 CommitDate: Mon Oct 3 06:04:21 2016 +0000
6 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=c7941d56
7
8 selinuxutil: allow setfiles to read semanage store
9
10 commit a7334eb0de98af11ec38b6263536fa01bc2a606c
11 libsemanage: validate and compile file contexts before installing
12
13 validates the fcontexts when they are still in /var/lib/selinux. Without
14 setfiles_t having access to read the files, validation fails and the
15 policy cannot be updated.
16
17 policy/modules/system/selinuxutil.if | 23 +++++++++++++++++++++++
18 policy/modules/system/selinuxutil.te | 1 +
19 2 files changed, 24 insertions(+)
20
21 diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
22 index b4c70a3..a8221f0 100644
23 --- a/policy/modules/system/selinuxutil.if
24 +++ b/policy/modules/system/selinuxutil.if
25 @@ -1107,6 +1107,29 @@ interface(`seutil_run_semanage',`
26
27 ########################################
28 ## <summary>
29 +## Read the semanage module store.
30 +## </summary>
31 +## <param name="domain">
32 +## <summary>
33 +## Domain allowed access.
34 +## </summary>
35 +## </param>
36 +#
37 +interface(`seutil_read_module_store',`
38 + gen_require(`
39 + type selinux_config_t, semanage_store_t;
40 + ')
41 +
42 + files_search_etc($1)
43 + files_search_var($1)
44 + list_dirs_pattern($1, selinux_config_t, semanage_store_t)
45 + list_dirs_pattern($1, semanage_store_t, semanage_store_t)
46 + read_files_pattern($1, semanage_store_t, semanage_store_t)
47 + read_lnk_files_pattern($1, semanage_store_t, semanage_store_t)
48 +')
49 +
50 +########################################
51 +## <summary>
52 ## Full management of the semanage
53 ## module store.
54 ## </summary>
55
56 diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
57 index 4a100cd..98d7840 100644
58 --- a/policy/modules/system/selinuxutil.te
59 +++ b/policy/modules/system/selinuxutil.te
60 @@ -597,6 +597,7 @@ logging_send_syslog_msg(setfiles_t)
61 miscfiles_read_localization(setfiles_t)
62
63 seutil_libselinux_linked(setfiles_t)
64 +seutil_read_module_store(setfiles_t)
65
66 userdom_use_all_users_fds(setfiles_t)
67 # for config files in a home directory