packages/selinux-policy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix context of ebtables

Browse Source
This commit is contained in:
luhuaxin 2021-06-09 10:24:39 +08:00
parent bbb7898a99
commit 95b77d5438
2 changed files with 88 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
backport-iptables.fc-Add-missing-legacy-entries.patch Normal file
View File

@ -0,0 +1,39 @@
From feefaa074e75466aa75c29f17a3d83ac6ce004f0 Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Thu, 18 Feb 2021 10:00:12 +0100
Subject: [PATCH] iptables.fc: Add missing legacy entries
The iptables, arptables, and ebtables stack is being deprecated in favor
of nftables. For now, netfilter reimplementations of these tools are
available for backwards compatibility, but have a diffferent filename
now (the main location is now a symlink). Add file context entries for
arptables and ebtables; iptables is already covered by the wildcard
rule.
This change fixed several ebtables-related denials for me.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
policy/modules/system/iptables.fc | 2 ++
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index 2c19023..9fb2e34 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -13,10 +13,12 @@
/usr/libexec/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/arptables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ebtables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
--
1.8.3.1

49
backport-iptables.fc-Remove-duplicate-file-context-entries.patch Normal file
View File

@ -0,0 +1,49 @@
From c33aa1f2bdb74f689bd54565e363fa67f3aa148f Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Thu, 18 Feb 2021 09:50:50 +0100
Subject: [PATCH] iptables.fc: Remove duplicate file context entries
There is an quivalency rule /sbin -> /usr/sbin so these are redundant.
A few entries were missing in the /usr/sbin block - add them to avoid
regressions.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
policy/modules/system/iptables.fc | 20 ++------------------
1 file changed, 2 insertions(+), 18 deletions(-)
diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index d8161fc..639a59b 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -12,25 +12,9 @@
/usr/libexec/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ip6?tables-restore.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ip6?tables-multi.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ipvsadm -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/nft -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/xtables-legacy-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/xtables-nft-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-
/usr/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
--
1.8.3.1