!112 fix context of ebtables

From: @HuaxinLuGitee
Reviewed-by: @zhujianwei001
Signed-off-by: @zhujianwei001

backport-iptables.fc-Add-missing-legacy-entries.patch

@@ -0,0 +1,39 @@
+From feefaa074e75466aa75c29f17a3d83ac6ce004f0 Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Thu, 18 Feb 2021 10:00:12 +0100
+Subject: [PATCH] iptables.fc: Add missing legacy entries
+
+The iptables, arptables, and ebtables stack is being deprecated in favor
+of nftables. For now, netfilter reimplementations of these tools are
+available for backwards compatibility, but have a diffferent filename
+now (the main location is now a symlink). Add file context entries for
+arptables and ebtables; iptables is already covered by the wildcard
+rule.
+
+This change fixed several ebtables-related denials for me.
+
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+---
+ policy/modules/system/iptables.fc | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
+index 2c19023..9fb2e34 100644
+--- a/policy/modules/system/iptables.fc
++++ b/policy/modules/system/iptables.fc
+@@ -13,10 +13,12 @@
+ /usr/libexec/ipset          --  gen_context(system_u:object_r:iptables_exec_t,s0)
+ 
+ /usr/sbin/arptables         --  gen_context(system_u:object_r:iptables_exec_t,s0)
++/usr/sbin/arptables-legacy      --  gen_context(system_u:object_r:iptables_exec_t,s0)
+ /usr/sbin/arptables-restore     --  gen_context(system_u:object_r:iptables_exec_t,s0)
+ /usr/sbin/arptables-save        --  gen_context(system_u:object_r:iptables_exec_t,s0)
+ /usr/sbin/conntrack		    --	gen_context(system_u:object_r:iptables_exec_t,s0)
+ /usr/sbin/ebtables		    --	gen_context(system_u:object_r:iptables_exec_t,s0)
++/usr/sbin/ebtables-legacy	    --	gen_context(system_u:object_r:iptables_exec_t,s0)
+ /usr/sbin/ebtables-restore	--	gen_context(system_u:object_r:iptables_exec_t,s0)
+ /usr/sbin/ipchains.*		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+ /usr/sbin/ip6?tables.*		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+-- 
+1.8.3.1
+

backport-iptables.fc-Remove-duplicate-file-context-entries.patch

@@ -0,0 +1,49 @@
+From c33aa1f2bdb74f689bd54565e363fa67f3aa148f Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Thu, 18 Feb 2021 09:50:50 +0100
+Subject: [PATCH] iptables.fc: Remove duplicate file context entries
+
+There is an quivalency rule /sbin -> /usr/sbin so these are redundant.
+A few entries were missing in the /usr/sbin block - add them to avoid
+regressions.
+
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+---
+ policy/modules/system/iptables.fc | 20 ++------------------
+ 1 file changed, 2 insertions(+), 18 deletions(-)
+
+diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
+index d8161fc..639a59b 100644
+--- a/policy/modules/system/iptables.fc
++++ b/policy/modules/system/iptables.fc
+@@ -12,25 +12,9 @@
+ 
+ /usr/libexec/ipset          --  gen_context(system_u:object_r:iptables_exec_t,s0)
+ 
+-/sbin/arptables             --  gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/arptables-restore     --  gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/arptables-save        --  gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ebtables			    --	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ebtables-restore		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ipchains.*		    --	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ip6?tables.*		    --	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ip6?tables-restore.*	--	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ip6?tables-multi.*	--	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ipset                 --  gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ipvsadm			    --	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ipvsadm-restore		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ipvsadm-save		    --	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/nft			--	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/xtables-multi		    --	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/xtables-legacy-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/xtables-nft-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+-
+ /usr/sbin/arptables         --  gen_context(system_u:object_r:iptables_exec_t,s0)
++/usr/sbin/arptables-restore     --  gen_context(system_u:object_r:iptables_exec_t,s0)
++/usr/sbin/arptables-save        --  gen_context(system_u:object_r:iptables_exec_t,s0)
+ /usr/sbin/conntrack		    --	gen_context(system_u:object_r:iptables_exec_t,s0)
+ /usr/sbin/ebtables		    --	gen_context(system_u:object_r:iptables_exec_t,s0)
+ /usr/sbin/ebtables-restore	--	gen_context(system_u:object_r:iptables_exec_t,s0)
+-- 
+1.8.3.1
+

selinux-policy.spec

@@ -12,7 +12,7 @@
 Summary: SELinux policy configuration
 Name:    selinux-policy
 Version: 3.14.2
-Release: 68
+Release: 69
 License: GPLv2+
 URL:     https://github.com/fedora-selinux/selinux-policy/
 
@@ -109,6 +109,8 @@ Patch6032: backport-Allow-dhcpc_t-domain-transition-to-chronyc_t.patch
 Patch6033: backport-Allow-nsswitch_domain-read-cgroup-files.patch
 Patch6034: backport-Allow-IPsec-and-certmonger-to-use-opencryptoki-servi.patch
 Patch6035: backport-Create-chronyd_pid_filetrans-interface.patch
+Patch6036: backport-iptables.fc-Remove-duplicate-file-context-entries.patch
+Patch6037: backport-iptables.fc-Add-missing-legacy-entries.patch
 
 BuildArch: noarch
 BuildRequires:  python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc
@@ -774,6 +776,9 @@ exit 0
 %endif
 
 %changelog
+* Mon Jun 7 2021 luhuaxin <1539327763@qq.com> - 3.14.2-69
+- fix context of ebtables
+
 * Mon May 31 2021 luhuaxin <1539327763@qq.com> - 3.14.2-68
 - backport some upstream patches
   backport-Allow-systemd-logind-dbus-chat-with-fwupd.patch