!57 add avc for openEuler on master

From: @HuaxinLuGitee
Reviewed-by: @zhujianwei001
Signed-off-by: @zhujianwei001

add-avc-for-openEuler-1.patch

@@ -0,0 +1,63 @@
+From 076002627934ea3f9ec59de1dde25a840bd1a452 Mon Sep 17 00:00:00 2001
+From: HuaxinLuGitee <1539327763@qq.com>
+Date: Sun, 13 Dec 2020 14:48:26 +0800
+Subject: [PATCH] add-avc-for-openEuler-1
+
+---
+ policy/modules/contrib/firewalld.te | 2 ++
+ policy/modules/contrib/logrotate.te | 4 +++-
+ policy/modules/system/init.te       | 1 +
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/policy/modules/contrib/firewalld.te b/policy/modules/contrib/firewalld.te
+index d23045d..d8c5f25 100644
+--- a/policy/modules/contrib/firewalld.te
++++ b/policy/modules/contrib/firewalld.te
+@@ -107,6 +107,8 @@ sysnet_relabelto_net_conf(firewalld_t)
+ userdom_dontaudit_create_admin_dir(firewalld_t)
+ userdom_dontaudit_manage_admin_dir(firewalld_t)
+ 
++files_rw_var_lib_dirs(firewalld_t)
++
+ optional_policy(`
+ 	dbus_system_domain(firewalld_t, firewalld_exec_t)
+ 
+diff --git a/policy/modules/contrib/logrotate.te b/policy/modules/contrib/logrotate.te
+index 98019eb..559c079 100644
+--- a/policy/modules/contrib/logrotate.te
++++ b/policy/modules/contrib/logrotate.te
+@@ -145,6 +145,7 @@ files_manage_generic_spool(logrotate_t)
+ files_manage_generic_spool_dirs(logrotate_t)
+ files_getattr_generic_locks(logrotate_t)
+ files_dontaudit_list_mnt(logrotate_t)
++files_list_var(logrotate_t)
+ 
+ fs_search_auto_mountpoints(logrotate_t)
+ fs_getattr_xattr_fs(logrotate_t)
+@@ -239,9 +240,10 @@ optional_policy(`
+ 
+ optional_policy(`
+ 	apache_read_config(logrotate_t)
+-    apache_read_sys_content_rw_dirs(logrotate_t)
++	apache_read_sys_content_rw_dirs(logrotate_t)
+ 	apache_domtrans(logrotate_t)
+ 	apache_signull(logrotate_t)
++	apache_read_sys_content(logrotate_t)
+ ')
+ 
+ optional_policy(`
+diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
+index d8ca280..0bc90bf 100644
+--- a/policy/modules/system/init.te
++++ b/policy/modules/system/init.te
+@@ -597,6 +597,7 @@ files_mounton_kernel_symbol_table(init_t)
+ files_manage_all_pid_dirs(init_t)
+ files_write_all_pid_sockets(init_t)
+ files_manage_etc_dirs(init_t)
++files_rw_etc_files(init_t)
+ files_manage_generic_tmp_dirs(init_t)
+ files_relabel_all_pid_dirs(init_t)
+ files_relabel_all_pid_files(init_t)
+-- 
+1.8.3.1
+

selinux-policy.spec

@@ -69,6 +69,7 @@ Patch16: allow-systemd_machined_t-delete-userdbd-runtime-sock.patch
 Patch17: allow-systemd-hostnamed-and-logind-read-policy.patch
 Patch18: add-firewalld-fc.patch
 Patch19: add-allow-systemd-timedated-to-unlink-etc-link.patch
+Patch20: add-avc-for-openEuler-1.patch
 
 BuildArch: noarch
 BuildRequires:  python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc
@@ -734,6 +735,9 @@ exit 0
 %endif
 
 %changelog
+* Sun Dec 13 2020 luhuaxin <1539327763@qq.com> - 3.14.2-64
+- add avc for openEuler
+
 * Tue Dec 8 2020 openEuler Buildteam <buildteam@openeuler.org> - 3.14.2-63
 - add allow systemd timedated to unlink etc link