packages/selinux-policy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add avc

Browse Source
This commit is contained in:
HuaxinLuGitee 2020-12-13 15:36:39 +08:00
parent b9f56b9c56
commit 8e67f056a6
2 changed files with 67 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
add-avc-for-openEuler-1.patch Normal file
View File

@ -0,0 +1,63 @@
From 076002627934ea3f9ec59de1dde25a840bd1a452 Mon Sep 17 00:00:00 2001
From: HuaxinLuGitee <1539327763@qq.com>
Date: Sun, 13 Dec 2020 14:48:26 +0800
Subject: [PATCH] add-avc-for-openEuler-1
---
policy/modules/contrib/firewalld.te | 2 ++
policy/modules/contrib/logrotate.te | 4 +++-
policy/modules/system/init.te | 1 +
3 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/policy/modules/contrib/firewalld.te b/policy/modules/contrib/firewalld.te
index d23045d..d8c5f25 100644
--- a/policy/modules/contrib/firewalld.te
+++ b/policy/modules/contrib/firewalld.te
@@ -107,6 +107,8 @@ sysnet_relabelto_net_conf(firewalld_t)
userdom_dontaudit_create_admin_dir(firewalld_t)
userdom_dontaudit_manage_admin_dir(firewalld_t)
+files_rw_var_lib_dirs(firewalld_t)
+
optional_policy(`
dbus_system_domain(firewalld_t, firewalld_exec_t)
diff --git a/policy/modules/contrib/logrotate.te b/policy/modules/contrib/logrotate.te
index 98019eb..559c079 100644
--- a/policy/modules/contrib/logrotate.te
+++ b/policy/modules/contrib/logrotate.te
@@ -145,6 +145,7 @@ files_manage_generic_spool(logrotate_t)
files_manage_generic_spool_dirs(logrotate_t)
files_getattr_generic_locks(logrotate_t)
files_dontaudit_list_mnt(logrotate_t)
+files_list_var(logrotate_t)
fs_search_auto_mountpoints(logrotate_t)
fs_getattr_xattr_fs(logrotate_t)
@@ -239,9 +240,10 @@ optional_policy(`
optional_policy(`
apache_read_config(logrotate_t)
- apache_read_sys_content_rw_dirs(logrotate_t)
+ apache_read_sys_content_rw_dirs(logrotate_t)
apache_domtrans(logrotate_t)
apache_signull(logrotate_t)
+ apache_read_sys_content(logrotate_t)
')
optional_policy(`
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index d8ca280..0bc90bf 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -597,6 +597,7 @@ files_mounton_kernel_symbol_table(init_t)
files_manage_all_pid_dirs(init_t)
files_write_all_pid_sockets(init_t)
files_manage_etc_dirs(init_t)
+files_rw_etc_files(init_t)
files_manage_generic_tmp_dirs(init_t)
files_relabel_all_pid_dirs(init_t)
files_relabel_all_pid_files(init_t)
--
1.8.3.1

4
selinux-policy.spec
View File

@ -69,6 +69,7 @@ Patch16: allow-systemd_machined_t-delete-userdbd-runtime-sock.patch
Patch17: allow-systemd-hostnamed-and-logind-read-policy.patch
Patch18: add-firewalld-fc.patch
Patch19: add-allow-systemd-timedated-to-unlink-etc-link.patch
Patch20: add-avc-for-openEuler-1.patch
BuildArch: noarch
BuildRequires: python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc
@ -734,6 +735,9 @@ exit 0
%endif
%changelog
* Sun Dec 13 2020 luhuaxin <1539327763@qq.com> - 3.14.2-64
- add avc for openEuler
* Tue Dec 8 2020 openEuler Buildteam <buildteam@openeuler.org> - 3.14.2-63
- add allow systemd timedated to unlink etc link