packages/selinux-policy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!112 fix context of ebtables

Browse Source 
From: @HuaxinLuGitee
Reviewed-by: @zhujianwei001
Signed-off-by: @zhujianwei001
This commit is contained in:
openeuler-ci-bot 2021-06-15 11:45:38 +00:00 committed by Gitee
commit f2160847b6
3 changed files with 94 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
backport-iptables.fc-Add-missing-legacy-entries.patch Normal file
View File

@ -0,0 +1,39 @@
From feefaa074e75466aa75c29f17a3d83ac6ce004f0 Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Thu, 18 Feb 2021 10:00:12 +0100
Subject: [PATCH] iptables.fc: Add missing legacy entries
The iptables, arptables, and ebtables stack is being deprecated in favor
of nftables. For now, netfilter reimplementations of these tools are
available for backwards compatibility, but have a diffferent filename
now (the main location is now a symlink). Add file context entries for
arptables and ebtables; iptables is already covered by the wildcard
rule.
This change fixed several ebtables-related denials for me.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
policy/modules/system/iptables.fc | 2 ++
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index 2c19023..9fb2e34 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -13,10 +13,12 @@
/usr/libexec/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/arptables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ebtables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
--
1.8.3.1

49
backport-iptables.fc-Remove-duplicate-file-context-entries.patch Normal file
View File

@ -0,0 +1,49 @@
From c33aa1f2bdb74f689bd54565e363fa67f3aa148f Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Thu, 18 Feb 2021 09:50:50 +0100
Subject: [PATCH] iptables.fc: Remove duplicate file context entries
There is an quivalency rule /sbin -> /usr/sbin so these are redundant.
A few entries were missing in the /usr/sbin block - add them to avoid
regressions.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
policy/modules/system/iptables.fc | 20 ++------------------
1 file changed, 2 insertions(+), 18 deletions(-)
diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index d8161fc..639a59b 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -12,25 +12,9 @@
/usr/libexec/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ip6?tables-restore.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ip6?tables-multi.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ipvsadm -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/nft -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/xtables-legacy-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/sbin/xtables-nft-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-
/usr/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
/usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
--
1.8.3.1

7
selinux-policy.spec
View File

@ -12,7 +12,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.14.2
Release: 68
Release: 69
License: GPLv2+
URL: https://github.com/fedora-selinux/selinux-policy/
@ -109,6 +109,8 @@ Patch6032: backport-Allow-dhcpc_t-domain-transition-to-chronyc_t.patch
Patch6033: backport-Allow-nsswitch_domain-read-cgroup-files.patch
Patch6034: backport-Allow-IPsec-and-certmonger-to-use-opencryptoki-servi.patch
Patch6035: backport-Create-chronyd_pid_filetrans-interface.patch
Patch6036: backport-iptables.fc-Remove-duplicate-file-context-entries.patch
Patch6037: backport-iptables.fc-Add-missing-legacy-entries.patch
BuildArch: noarch
BuildRequires: python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc
@ -774,6 +776,9 @@ exit 0
%endif
%changelog
* Mon Jun 7 2021 luhuaxin <1539327763@qq.com> - 3.14.2-69
- fix context of ebtables
* Mon May 31 2021 luhuaxin <1539327763@qq.com> - 3.14.2-68
- backport some upstream patches
backport-Allow-systemd-logind-dbus-chat-with-fwupd.patch