124 lines
4.5 KiB
Diff
124 lines
4.5 KiB
Diff
|
From 1a6889def34747b606f4e520fbff72fe86f90b0f Mon Sep 17 00:00:00 2001
|
||
|
|
From: lujie42 <572084868@qq.com>
|
||
|
|
Date: Tue, 24 Aug 2021 15:38:40 +0800
|
||
|
|
Subject: [PATCH] add avc for systemd no17479
|
||
|
|
|
||
|
|
Signed-off-by: lujie42 <572084868@qq.com>
|
||
|
|
---
|
||
|
|
policy/modules/kernel/domain.te | 4 ++--
|
||
|
|
policy/modules/kernel/selinux.if | 2 +-
|
||
|
|
policy/modules/system/logging.te | 1 +
|
||
|
|
policy/modules/system/systemd.if | 7 ++++---
|
||
|
|
policy/modules/system/systemd.te | 3 +++
|
||
|
|
5 files changed, 11 insertions(+), 6 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
|
||
|
|
index 8e52b17..27b112c 100644
|
||
|
|
--- a/policy/modules/kernel/domain.te
|
||
|
|
+++ b/policy/modules/kernel/domain.te
|
||
|
|
@@ -510,7 +510,7 @@ optional_policy(`
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
- systemd_dbus_chat_resolved(domain)
|
||
|
|
+ systemd_chat_resolved(domain)
|
||
|
|
systemd_login_status(unconfined_domain_type)
|
||
|
|
systemd_login_reboot(unconfined_domain_type)
|
||
|
|
systemd_login_halt(unconfined_domain_type)
|
||
|
|
@@ -519,7 +519,7 @@ optional_policy(`
|
||
|
|
systemd_filetrans_named_content(named_filetrans_domain)
|
||
|
|
systemd_filetrans_named_hostname(named_filetrans_domain)
|
||
|
|
systemd_filetrans_home_content(named_filetrans_domain)
|
||
|
|
- systemd_dontaudit_write_inherited_logind_sessions_pipes(domain)
|
||
|
|
+ systemd_dontaudit_write_inherited_logind_sessions_pipes(domain)
|
||
|
|
')
|
||
|
|
|
||
|
|
optional_policy(`
|
||
|
|
diff --git a/policy/modules/kernel/selinux.if b/policy/modules/kernel/selinux.if
|
||
|
|
index ac70efb..a2ab3fc 100644
|
||
|
|
--- a/policy/modules/kernel/selinux.if
|
||
|
|
+++ b/policy/modules/kernel/selinux.if
|
||
|
|
@@ -324,7 +324,7 @@ interface(`selinux_get_enforce_mode',`
|
||
|
|
dev_search_sysfs($1)
|
||
|
|
selinux_get_fs_mount($1)
|
||
|
|
allow $1 security_t:dir list_dir_perms;
|
||
|
|
- allow $1 security_t:file read_file_perms;
|
||
|
|
+ allow $1 security_t:file mmap_read_file_perms;
|
||
|
|
allow $1 security_t:lnk_file read_lnk_file_perms;
|
||
|
|
')
|
||
|
|
|
||
|
|
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
|
||
|
|
index df4e985..482fe6d 100644
|
||
|
|
--- a/policy/modules/system/logging.te
|
||
|
|
+++ b/policy/modules/system/logging.te
|
||
|
|
@@ -622,6 +622,7 @@ term_write_unallocated_ttys(syslogd_t)
|
||
|
|
term_use_generic_ptys(syslogd_t)
|
||
|
|
|
||
|
|
init_stream_connect(syslogd_t)
|
||
|
|
+init_read_pid_files(syslogd_t)
|
||
|
|
# for sending messages to logged in users
|
||
|
|
init_read_utmp(syslogd_t)
|
||
|
|
init_dontaudit_write_utmp(syslogd_t)
|
||
|
|
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
|
||
|
|
index 514bbd7..6503c87 100644
|
||
|
|
--- a/policy/modules/system/systemd.if
|
||
|
|
+++ b/policy/modules/system/systemd.if
|
||
|
|
@@ -2345,8 +2345,8 @@ interface(`systemd_map_resolved_exec_files',`
|
||
|
|
|
||
|
|
########################################
|
||
|
|
## <summary>
|
||
|
|
-## Send and receive messages from
|
||
|
|
-## systemd resolved over dbus.
|
||
|
|
+## Exchange messages with
|
||
|
|
+## systemd resolved over dbus or varlink.
|
||
|
|
## </summary>
|
||
|
|
## <param name="domain">
|
||
|
|
## <summary>
|
||
|
|
@@ -2354,13 +2354,14 @@ interface(`systemd_map_resolved_exec_files',`
|
||
|
|
## </summary>
|
||
|
|
## </param>
|
||
|
|
#
|
||
|
|
-interface(`systemd_dbus_chat_resolved',`
|
||
|
|
+interface(`systemd_chat_resolved',`
|
||
|
|
gen_require(`
|
||
|
|
type systemd_resolved_t;
|
||
|
|
class dbus send_msg;
|
||
|
|
')
|
||
|
|
|
||
|
|
allow $1 systemd_resolved_t:dbus send_msg;
|
||
|
|
+ allow $1 systemd_resolved_t:unix_stream_socket connectto;
|
||
|
|
allow systemd_resolved_t $1:dbus send_msg;
|
||
|
|
ps_process_pattern(systemd_resolved_t, $1)
|
||
|
|
')
|
||
|
|
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
|
||
|
|
index 1e96c31..7849d51 100644
|
||
|
|
--- a/policy/modules/system/systemd.te
|
||
|
|
+++ b/policy/modules/system/systemd.te
|
||
|
|
@@ -13,6 +13,7 @@ attribute systemd_private_tmp_type;
|
||
|
|
|
||
|
|
attribute systemd_read_efivarfs_type;
|
||
|
|
fs_read_efivarfs_files(systemd_read_efivarfs_type)
|
||
|
|
+read_files_pattern(systemd_read_efivarfs_type, init_var_run_t, init_var_run_t)
|
||
|
|
|
||
|
|
systemd_domain_template(systemd_logger)
|
||
|
|
systemd_domain_template(systemd_logind)
|
||
|
|
@@ -501,6 +502,7 @@ corenet_tcp_bind_dhcpd_port(systemd_networkd_t)
|
||
|
|
corenet_udp_bind_dhcpd_port(systemd_networkd_t)
|
||
|
|
|
||
|
|
fs_read_xenfs_files(systemd_networkd_t)
|
||
|
|
+fs_read_nsfs_files(systemd_networkd_t)
|
||
|
|
|
||
|
|
dev_read_sysfs(systemd_networkd_t)
|
||
|
|
dev_write_kmsg(systemd_networkd_t)
|
||
|
|
@@ -1066,6 +1068,7 @@ allow systemd_resolved_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
|
||
|
|
manage_dirs_pattern(systemd_resolved_t, systemd_resolved_var_run_t, systemd_resolved_var_run_t)
|
||
|
|
manage_files_pattern(systemd_resolved_t, systemd_resolved_var_run_t, systemd_resolved_var_run_t)
|
||
|
|
+manage_sock_files_pattern(systemd_resolved_t, systemd_resolved_var_run_t, systemd_resolved_var_run_t)
|
||
|
|
manage_lnk_files_pattern(systemd_resolved_t, systemd_resolved_var_run_t, systemd_resolved_var_run_t)
|
||
|
|
init_pid_filetrans(systemd_resolved_t, systemd_resolved_var_run_t, dir)
|
||
|
|
|
||
|
|
--
|
||
|
|
1.8.3.1
|
||
|
|
|