packages/selinux-policy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[backport] iptables.fc: Add missing legacy-restore and legacy-save entries

Browse Source
This commit is contained in:
luhuaxin 2021-06-17 21:40:29 +08:00
parent f2160847b6
commit c1e30c15e9
2 changed files with 45 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
backport-iptables.fc-Add-missing-legacy-restore-and-legacy-sa.patch Normal file
View File

@ -0,0 +1,40 @@
From dfbaf8f3be6470e0964df8c1b5ae9717f85a4675 Mon Sep 17 00:00:00 2001
From: LuLuLu <1539327763@qq.com>
Date: Fri, 11 Jun 2021 11:25:18 +0800
Subject: [PATCH] iptables.fc: Add missing legacy-restore and legacy-save
entries
/usr/sbin/ebtables-restore and /usr/sbin/ebtables-save are miss labeled now. Each of them is a link file that can link to two differenet files.
For /usr/sbin/ebtables-restore on fc 34:
Remove iptables-nft and install ebtables-legacy:
lrwxrwxrwx. 1 root root 34 Apr 23 06:56 /sbin/ebtables-restore -> /etc/alternatives/ebtables-restore
lrwxrwxrwx. 1 root root 33 Jun 10 20:31 /etc/alternatives/ebtables-restore -> /usr/sbin/ebtables-legacy-restore
Remove ebtables-legacy and install iptables-nft:
lrwxrwxrwx. 1 root root 34 Apr 23 06:56 /sbin/ebtables-restore -> /etc/alternatives/ebtables-restore
lrwxrwxrwx. 1 root root 30 Jun 10 20:35 /etc/alternatives/ebtables-restore -> /usr/sbin/ebtables-nft-restore
lrwxrwxrwx. 1 root root 17 Jan 28 08:48 /usr/sbin/ebtables-nft-restore -> xtables-nft-multi
/sbin/ebtables-save is similar. But the label of /usr/sbin/ebtables-legacy-restore and /usr/sbin/ebtables-legacy-save is lack.
---
policy/modules/system/iptables.fc | 2 ++
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index 9fb2e34..e8ee5c0 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -19,6 +19,8 @@
/usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ebtables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ebtables-legacy-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ebtables-legacy-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
--
1.8.3.1

6
selinux-policy.spec
View File

@ -12,7 +12,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.14.2
Release: 69
Release: 70
License: GPLv2+
URL: https://github.com/fedora-selinux/selinux-policy/
@ -111,6 +111,7 @@ Patch6034: backport-Allow-IPsec-and-certmonger-to-use-opencryptoki-servi.patch
Patch6035: backport-Create-chronyd_pid_filetrans-interface.patch
Patch6036: backport-iptables.fc-Remove-duplicate-file-context-entries.patch
Patch6037: backport-iptables.fc-Add-missing-legacy-entries.patch
Patch6038: backport-iptables.fc-Add-missing-legacy-restore-and-legacy-sa.patch
BuildArch: noarch
BuildRequires: python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc
@ -776,6 +777,9 @@ exit 0
%endif
%changelog
* Thu Jun 17 2021 luhuaxin <1539327763@qq.com> - 3.14.2-70
- iptables.fc: Add missing legacy-restore and legacy-save entries
* Mon Jun 7 2021 luhuaxin <1539327763@qq.com> - 3.14.2-69
- fix context of ebtables