-
Notifications
You must be signed in to change notification settings - Fork 113
selinux: update #917
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
selinux: update #917
Changes from all commits
Commits
Show all changes
22 commits
Select commit
Hold shift + click to select a range
b0810f4
eclass: sync selinux-policy-2 with Gentoo
tormath1 7132f52
sys-libs/libselinux: sync with Gentoo
tormath1 c4a353d
sys-libs/libsepol: sync with Gentoo
tormath1 d78e4b3
sys-apps/policycoreutils: sync with Gentoo
tormath1 a38d44b
sys-apps/policycoreutils: apply flatcar changes
tormath1 e1ff975
sys-libs/libsemanage: sync with Gentoo
tormath1 90bd28e
sys-libs/libsemanage: apply flatcar patches
tormath1 cd2d678
sys-apps/checkpolicy: sync with Gentoo
tormath1 3de5229
sec-policy/selinux-base: sync with Gentoo
tormath1 ac520d6
coreos/user-patches: add selinux-base
tormath1 6b7c247
sec-policy/selinux-base-policy: sync with Gentoo
tormath1 2af995d
coreos/user-patches: add selinux-base-policy
tormath1 1e2b1c9
sec-policy/selinux-virt: drop ebuild
tormath1 1306dfe
sec-policy/selinux-container: add new package
tormath1 206b71a
coreos/user-patches: add selinux-container
tormath1 eed7eb6
sec-policy/selinux-sssd: sync with Gentoo
tormath1 af5400c
sec-policy/selinux-unconfined: sync with Gentoo
tormath1 077dd23
sec-policys/selinux-dbus: add new package
tormath1 a07620c
changelog: add entries
tormath1 678dfd7
sys-apps/semodule-utils: sync with Gentoo
tormath1 0d3c1a5
coreos-base/misc-files: add SELinux config
tormath1 c3ba668
.github: add more packages to automation
tormath1 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| - libselinux ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - libsepol ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - semodule-utils ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - policycoreutils ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - libsemanage ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - checkpolicy ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - selinux-base ([2.20221101](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20221101)) | ||
| - selinux-base-policy ([2.20221101](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20221101)) | ||
| - selinux-container ([2.20221101](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20221101)) | ||
| - selinux-sssd ([2.20221101](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20221101)) | ||
| - selinux-unconfined ([2.20221101](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20221101)) |
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 2 additions & 0 deletions
2
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sec-policy/selinux-base
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| PKG_INSTALL_MASK+=" /etc/selinux/config" | ||
| INSTALL_MASK+=" /etc/selinux/config" |
4 changes: 2 additions & 2 deletions
4
...licy/selinux-base-policy/files/init.patch → ...sec-policy/selinux-base-policy/init.patch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
6 changes: 3 additions & 3 deletions
6
...elinux-base-policy/files/locallogin.patch → ...licy/selinux-base-policy/locallogin.patch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
14 changes: 7 additions & 7 deletions
14
...y/selinux-base-policy/files/logging.patch → ...-policy/selinux-base-policy/logging.patch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,18 +1,18 @@ | ||
| diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te | ||
| index 7d713540d..d6cbc654d 100644 | ||
| --- refpolicy/policy/modules/system/logging.te | ||
| +++ refpolicy/policy/modules/system/logging.te | ||
| @@ -516,11 +516,13 @@ userdom_dontaudit_use_unpriv_user_fds(syslogd_t) | ||
| userdom_dontaudit_search_user_home_dirs(syslogd_t) | ||
| index abd61e6bd..fb5d69366 100644 | ||
| --- a/refpolicy/policy/modules/system/logging.te | ||
| +++ b/refpolicy/policy/modules/system/logging.te | ||
| @@ -525,11 +525,13 @@ userdom_dontaudit_search_user_home_dirs(syslogd_t) | ||
|
|
||
| ifdef(`init_systemd',` | ||
| + require { type kernel_t; } | ||
| # for systemd-journal | ||
| + require { type kernel_t; } | ||
| allow syslogd_t self:capability audit_control; | ||
| allow syslogd_t self:netlink_audit_socket connected_socket_perms; | ||
| allow syslogd_t self:capability2 audit_read; | ||
| allow syslogd_t self:capability { chown setgid setuid sys_ptrace }; | ||
| allow syslogd_t self:netlink_audit_socket { getattr getopt read setopt write nlmsg_write }; | ||
| + allow syslogd_t kernel_t:netlink_audit_socket getattr; | ||
| + allow syslogd_t kernel_t:netlink_audit_socket getattr; | ||
|
|
||
| # remove /run/log/journal when switching to permanent storage | ||
| allow syslogd_t var_log_t:dir rmdir; |
10 changes: 5 additions & 5 deletions
10
...licy/selinux-base-policy/files/ping.patch → ...sec-policy/selinux-base-policy/ping.patch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,19 +1,19 @@ | ||
| diff -u -r refpolicy/policy/modules/admin/netutils.te refpolicy/policy/modules/admin/netutils.te | ||
| --- refpolicy/policy/modules/admin/netutils.te 2022-01-12 14:28:26.850809330 -0000 | ||
| +++ refpolicy/policy/modules/admin/netutils.te 2022-01-12 14:29:50.323880882 -0000 | ||
| --- a/refpolicy/policy/modules/admin/netutils.te 2022-01-12 14:28:26.850809330 -0000 | ||
| +++ b/refpolicy/policy/modules/admin/netutils.te 2022-01-12 14:29:50.323880882 -0000 | ||
| @@ -117,6 +117,7 @@ | ||
| corenet_raw_sendrecv_generic_node(ping_t) | ||
| corenet_tcp_sendrecv_generic_node(ping_t) | ||
| corenet_raw_bind_generic_node(ping_t) | ||
| +corenet_icmp_bind_generic_node(ping_t) | ||
|
|
||
| dev_read_urand(ping_t) | ||
|
|
||
| @@ -189,6 +190,7 @@ | ||
| corenet_tcp_connect_all_ports(traceroute_t) | ||
| corenet_sendrecv_all_client_packets(traceroute_t) | ||
| corenet_sendrecv_traceroute_server_packets(traceroute_t) | ||
| +corenet_icmp_bind_generic_node(traceroute_t) | ||
|
|
||
| dev_read_rand(traceroute_t) | ||
| dev_read_urand(traceroute_t) |
16 changes: 16 additions & 0 deletions
16
...ches/sec-policy/selinux-base/0001-policy-modules-kernel-all-more-actions-for-kernel.patch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| diff --git refpolicy/policy/modules/kernel/kernel.te refpolicy/policy/modules/kernel/kernel.te | ||
| index 56dbd5af5..b5cf0e3c0 100644 | ||
| --- a/refpolicy/policy/modules/kernel/kernel.te | ||
| +++ b/refpolicy/policy/modules/kernel/kernel.te | ||
| @@ -363,6 +363,11 @@ files_list_home(kernel_t) | ||
| files_read_usr_files(kernel_t) | ||
|
|
||
| mcs_process_set_categories(kernel_t) | ||
| +mcs_killall(kernel_t) | ||
| +mcs_file_read_all(kernel_t) | ||
| +mcs_file_write_all(kernel_t) | ||
| +mcs_ptrace_all(kernel_t) | ||
| +allow kernel_t self:user_namespace create; | ||
|
|
||
| mls_process_read_all_levels(kernel_t) | ||
| mls_process_write_all_levels(kernel_t) |
44 changes: 44 additions & 0 deletions
44
...hird_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-base/files-relabel.patch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if | ||
| index 495cbe2f4..a5605f866 100644 | ||
| --- a/refpolicy/policy/modules/kernel/files.if | ||
| +++ b/refpolicy/policy/modules/kernel/files.if | ||
| @@ -7892,3 +7892,39 @@ interface(`files_unconfined',` | ||
|
|
||
| typeattribute $1 files_unconfined_type; | ||
| ') | ||
| + | ||
| +######################################## | ||
| +## <summary> | ||
| +## Relabel all files on the filesystem, except | ||
| +## policy_config_t and exceptions. | ||
| +## </summary> | ||
| +## <param name="domain"> | ||
| +## <summary> | ||
| +## Domain allowed access. | ||
| +## </summary> | ||
| +## </param> | ||
| +## <param name="exception_types" optional="true"> | ||
| +## <summary> | ||
| +## The types to be excluded. Each type or attribute | ||
| +## must be negated by the caller. | ||
| +## </summary> | ||
| +## </param> | ||
| +## <rolecap/> | ||
| +# | ||
| +interface(`files_relabel_all_non_policy_files',` | ||
| + gen_require(` | ||
| + attribute file_type; | ||
| + type policy_config_t; | ||
| + ') | ||
| + | ||
| + allow $1 { file_type -policy_config_t $2 }:dir list_dir_perms; | ||
| + relabel_dirs_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + relabel_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + relabel_lnk_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + relabel_fifo_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + relabel_sock_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + # this is only relabelfrom since there should be no | ||
| + # device nodes with file types. | ||
| + relabelfrom_blk_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + relabelfrom_chr_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| +') |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
77 changes: 77 additions & 0 deletions
77
...ird_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-container/container.patch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| diff --git a/policy/modules/services/container.fc b/policy/modules/services/container.fc | ||
| index 056aa6023..e4bcada03 100644 | ||
| --- a/refpolicy/policy/modules/services/container.fc | ||
| +++ b/refpolicy/policy/modules/services/container.fc | ||
| @@ -113,3 +113,5 @@ HOME_DIR/\.docker(/.*)? gen_context(system_u:object_r:container_conf_home_t,s0) | ||
| /var/log/kube-controller-manager(/.*)? gen_context(system_u:object_r:container_log_t,s0) | ||
| /var/log/kube-proxy(/.*)? gen_context(system_u:object_r:container_log_t,s0) | ||
| /var/log/kube-scheduler(/.*)? gen_context(system_u:object_r:container_log_t,s0) | ||
| + | ||
| +/usr/share/containerd(/.*)? gen_context(system_u:object_r:container_config_t,s0) | ||
| diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te | ||
| index 5de421fc3..4a6c2760e 100644 | ||
| --- a/refpolicy/policy/modules/services/container.te | ||
| +++ b/refpolicy/policy/modules/services/container.te | ||
| @@ -1007,3 +1007,62 @@ optional_policy(` | ||
| unconfined_domain_noaudit(spc_user_t) | ||
| domain_ptrace_all_domains(spc_user_t) | ||
| ') | ||
| + | ||
| +allow container_domain self:socket_class_set { accept ioctl read getattr lock write append getopt setopt }; | ||
| +allow container_domain init_t:unix_stream_socket { accept ioctl read getattr lock write append getopt shutdown }; | ||
| + | ||
| +# required for sharing /run for the etcd-wrapper | ||
| +files_mounton_runtime_dirs(container_engine_domain) | ||
| + | ||
| +# this is a hack while the system is not labelled. we need to authorize transition from kernel_t | ||
| +require { | ||
| + type kernel_t; | ||
| + type tmpfs_t; | ||
| + type var_lib_t; | ||
| + type unconfined_t; | ||
| +} | ||
| +allow kernel_t container_t:process transition; | ||
| +allow initrc_t container_t:process transition; | ||
| +allow kernel_t container_t:process2 nnp_transition; | ||
| +allow kernel_t unconfined_t:process transition; | ||
| +fs_manage_tmpfs_chr_files(container_t) | ||
| +fs_manage_tmpfs_dirs(container_t) | ||
| +fs_manage_tmpfs_files(container_t) | ||
| +fs_manage_tmpfs_sockets(container_t) | ||
| +fs_manage_tmpfs_symlinks(container_t) | ||
| +fs_remount_tmpfs(container_t) | ||
| +kernel_read_messages(container_t) | ||
| +kernel_sigchld(container_t) | ||
| +kernel_use_fds(container_t) | ||
| +allow container_t self:process getcap; | ||
| +files_read_var_lib_files(container_t) | ||
| +files_read_var_lib_symlinks(container_t) | ||
| +term_use_generic_ptys(container_t) | ||
| +term_setattr_generic_ptys(container_t) | ||
| +allow container_t tmpfs_t:chr_file { read write open }; | ||
| +allow container_t container_file_t:chr_file { manage_file_perms }; | ||
| +allow container_t self:capability sys_chroot; | ||
| +allow container_t self:process getpgid; | ||
| +allow container_t container_file_t:file { entrypoint mounton }; | ||
| +allow container_t var_lib_t:file { entrypoint execute execute_no_trans }; | ||
| +allow container_t kernel_t:fifo_file { getattr ioctl read write open append }; | ||
| +allow container_t initrc_t:fifo_file { getattr ioctl read write open append }; | ||
| +filetrans_pattern(kernel_t, etc_t, container_file_t, dir, "cni"); | ||
| + | ||
| +# this is required by flanneld | ||
| +allow container_t kernel_t:system { module_request }; | ||
| + | ||
| +# required by flanneld to write into /run/flannel/subnet.env | ||
| +filetrans_pattern(kernel_t, var_run_t, container_file_t, dir, "flannel"); | ||
| + | ||
| +# required for cilium | ||
| +allow kernel_t spc_t:process transition; | ||
| +# required for cilium, can be upstreamed | ||
| +# Jun 20 08:01:43 localhost audit[3480]: AVC avc: denied { open } for pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1 | ||
| +# Jun 20 08:01:43 localhost audit[3480]: AVC avc: denied { kernel } for pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1 | ||
| +# Jun 20 08:01:43 localhost audit[3480]: AVC avc: denied { cpu } for pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1 | ||
| +# Jun 20 08:01:43 localhost audit[3480]: AVC avc: denied { read } for pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1 | ||
| +allow spc_t self:perf_event { open cpu kernel read }; | ||
| +# required for using cilium cgroup v1 | ||
| +allow kernel_t self:perf_event { open cpu kernel read }; | ||
| +allow unconfined_t container_file_t:file { entrypoint }; |
4 changes: 0 additions & 4 deletions
4
sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/Manifest
This file was deleted.
Oops, something went wrong.
22 changes: 0 additions & 22 deletions
22
sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/sshd.patch
This file was deleted.
Oops, something went wrong.
11 changes: 0 additions & 11 deletions
11
...ainer/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/unlabeled.patch
This file was deleted.
Oops, something went wrong.
4 changes: 0 additions & 4 deletions
4
sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base/Manifest
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.