Package init
This commit is contained in:
overweight
commit
fcfd975340
28
Fix-bug-in-userdom_restricted_xwindows_user_template.patch
Normal file
28
Fix-bug-in-userdom_restricted_xwindows_user_template.patch
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
From 0269451c9568aa7939b0fef6708d867fcd2ffd47 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Lukas Vrabec <lvrabec@redhat.com>
|
||||||
|
Date: Thu, 21 Feb 2019 16:12:18 +0100
|
||||||
|
Subject: [PATCH 083/109] Fix bug in
|
||||||
|
userdom_restricted_xwindows_user_template() template to disallow all user
|
||||||
|
domains to access admin_home_t
|
||||||
|
|
||||||
|
Fixes: #221
|
||||||
|
---
|
||||||
|
policy/modules/system/userdomain.if | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
||||||
|
index 90a8a7533..4988fdd41 100644
|
||||||
|
--- a/policy/modules/system/userdomain.if
|
||||||
|
+++ b/policy/modules/system/userdomain.if
|
||||||
|
@@ -1345,7 +1345,7 @@ template(`userdom_restricted_xwindows_user_template',`
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
pulseaudio_role($1_r, $1_usertype)
|
||||||
|
- pulseaudio_filetrans_admin_home_content($1_usertype)
|
||||||
|
+ pulseaudio_filetrans_home_content($1_usertype)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
--
|
||||||
|
2.19.1
|
||||||
|
|
||||||
28
Fix-userdom_admin_user_template-interface-by-adding-.patch
Normal file
28
Fix-userdom_admin_user_template-interface-by-adding-.patch
Normal file
@ -0,0 +1,28 @@
|
|||||||
|
From a207f43eacab87fc54a175b8dd2db68ca231e965 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Lukas Vrabec <lvrabec@redhat.com>
|
||||||
|
Date: Thu, 24 Jan 2019 16:46:39 +0100
|
||||||
|
Subject: [PATCH 064/109] Fix userdom_admin_user_template() interface by adding
|
||||||
|
bluetooth,alg,dccp create_stream_socket permissions.
|
||||||
|
|
||||||
|
---
|
||||||
|
policy/modules/system/userdomain.if | 4 ++--
|
||||||
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
||||||
|
index 5059b4a21..8b9abecbd 100644
|
||||||
|
--- a/policy/modules/system/userdomain.if
|
||||||
|
+++ b/policy/modules/system/userdomain.if
|
||||||
|
@@ -1582,8 +1582,8 @@ template(`userdom_admin_user_template',`
|
||||||
|
allow $1_t self:passwd crontab;
|
||||||
|
|
||||||
|
allow $1_t self:bluetooth_socket create_stream_socket_perms;
|
||||||
|
- allow $1_t self:alg_socket create_socket_perms;
|
||||||
|
- allow $1_t self:dccp_socket create_socket_perms;
|
||||||
|
+ allow $1_t self:alg_socket create_stream_socket_perms;
|
||||||
|
+ allow $1_t self:dccp_socket create_stream_socket_perms;
|
||||||
|
|
||||||
|
allow $1_t self:cap_userns sys_ptrace;
|
||||||
|
|
||||||
|
--
|
||||||
|
2.19.1
|
||||||
|
|
||||||
26
Fix-userdom_write_user_tmp_dirs-to-allow-caller-doma.patch
Normal file
26
Fix-userdom_write_user_tmp_dirs-to-allow-caller-doma.patch
Normal file
@ -0,0 +1,26 @@
|
|||||||
|
From debf07213f1c423a3a6504dd027792b14426f07e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Lukas Vrabec <lvrabec@redhat.com>
|
||||||
|
Date: Wed, 17 Oct 2018 13:24:41 +0200
|
||||||
|
Subject: [PATCH 003/109] Fix userdom_write_user_tmp_dirs() to allow caller
|
||||||
|
domain also read/write user_tmp_t dirs
|
||||||
|
|
||||||
|
---
|
||||||
|
policy/modules/system/userdomain.if | 2 ++
|
||||||
|
1 file changed, 2 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
||||||
|
index 44acc0cbc..5059b4a21 100644
|
||||||
|
--- a/policy/modules/system/userdomain.if
|
||||||
|
+++ b/policy/modules/system/userdomain.if
|
||||||
|
@@ -5332,6 +5332,8 @@ interface(`userdom_write_user_tmp_dirs',`
|
||||||
|
type user_tmp_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
+ list_dirs_pattern($1, user_tmp_t, user_tmp_t)
|
||||||
|
+ rw_dirs_pattern($1, user_tmp_t, user_tmp_t)
|
||||||
|
write_files_pattern($1, user_tmp_t, user_tmp_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
--
|
||||||
|
2.19.1
|
||||||
|
|
||||||
33
Fixing-range-for-ephemeral-ports-BZ-1518807.patch
Normal file
33
Fixing-range-for-ephemeral-ports-BZ-1518807.patch
Normal file
@ -0,0 +1,33 @@
|
|||||||
|
From f135894a52444d4912050f7b4d449f495241e791 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Lukas Vrabec <lvrabec@redhat.com>
|
||||||
|
Date: Wed, 12 Dec 2018 15:55:16 +0100
|
||||||
|
Subject: [PATCH 043/109] Fixing range for ephemeral ports BZ(1518807)
|
||||||
|
|
||||||
|
Range of ephemeral ports is 32768-60999 based on:
|
||||||
|
|
||||||
|
# sysctl net.ipv4.ip_local_port_range
|
||||||
|
net.ipv4.ip_local_port_range = 32768 60999
|
||||||
|
---
|
||||||
|
policy/modules/kernel/corenetwork.te.in | 4 ++--
|
||||||
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
|
||||||
|
index ff8ce41e8..b9b1f21e9 100644
|
||||||
|
--- a/policy/modules/kernel/corenetwork.te.in
|
||||||
|
+++ b/policy/modules/kernel/corenetwork.te.in
|
||||||
|
@@ -398,10 +398,10 @@ portcon tcp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)
|
||||||
|
portcon udp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)
|
||||||
|
portcon sctp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)
|
||||||
|
portcon tcp 1024-32767 gen_context(system_u:object_r:unreserved_port_t, s0)
|
||||||
|
-portcon tcp 32768-61000 gen_context(system_u:object_r:ephemeral_port_t, s0)
|
||||||
|
+portcon tcp 32768-60999 gen_context(system_u:object_r:ephemeral_port_t, s0)
|
||||||
|
portcon tcp 61001-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
|
||||||
|
portcon udp 1024-32767 gen_context(system_u:object_r:unreserved_port_t, s0)
|
||||||
|
-portcon udp 32768-61000 gen_context(system_u:object_r:ephemeral_port_t, s0)
|
||||||
|
+portcon udp 32768-60999 gen_context(system_u:object_r:ephemeral_port_t, s0)
|
||||||
|
portcon udp 61001-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
|
||||||
|
|
||||||
|
########################################
|
||||||
|
--
|
||||||
|
2.19.1
|
||||||
|
|
||||||
22
Makefile.devel
Normal file
22
Makefile.devel
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
# installation paths
|
||||||
|
SHAREDIR := /usr/share/selinux
|
||||||
|
|
||||||
|
AWK ?= gawk
|
||||||
|
NAME ?= $(strip $(shell $(AWK) -F= '/^SELINUXTYPE/{ print $$2 }' /etc/selinux/config))
|
||||||
|
|
||||||
|
ifeq ($(MLSENABLED),)
|
||||||
|
MLSENABLED := 1
|
||||||
|
endif
|
||||||
|
|
||||||
|
ifeq ($(MLSENABLED),1)
|
||||||
|
NTYPE = mcs
|
||||||
|
endif
|
||||||
|
|
||||||
|
ifeq ($(NAME),mls)
|
||||||
|
NTYPE = mls
|
||||||
|
endif
|
||||||
|
|
||||||
|
TYPE ?= $(NTYPE)
|
||||||
|
|
||||||
|
HEADERDIR := $(SHAREDIR)/devel/include
|
||||||
|
include $(HEADERDIR)/Makefile
|
||||||
15
add_syslogd_t_domtrans_logrotate.patch
Normal file
15
add_syslogd_t_domtrans_logrotate.patch
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
|
||||||
|
index 37a1c06..c524b01 100644
|
||||||
|
--- a/policy/modules/system/logging.te
|
||||||
|
+++ b/policy/modules/system/logging.te
|
||||||
|
@@ -696,6 +696,10 @@ optional_policy(`
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
+ logrotate_domtrans(syslogd_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
udev_read_db(syslogd_t)
|
||||||
|
')
|
||||||
|
|
||||||
52
add_userman_access_run_dir.patch
Normal file
52
add_userman_access_run_dir.patch
Normal file
@ -0,0 +1,52 @@
|
|||||||
|
diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
|
||||||
|
index e069cb5..43fed66 100644
|
||||||
|
--- a/policy/modules/admin/usermanage.te
|
||||||
|
+++ b/policy/modules/admin/usermanage.te
|
||||||
|
@@ -250,6 +250,11 @@ files_relabel_etc_files(groupadd_t)
|
||||||
|
files_read_etc_files(groupadd_t)
|
||||||
|
files_read_etc_runtime_files(groupadd_t)
|
||||||
|
files_read_usr_symlinks(groupadd_t)
|
||||||
|
+files_search_pids(groupadd_t)
|
||||||
|
+files_create_var_run_dirs(groupadd_t)
|
||||||
|
+files_delete_all_pids(groupadd_t)
|
||||||
|
+allow groupadd_t var_run_t:file *;
|
||||||
|
+allow groupadd_t var_run_t:dir *;
|
||||||
|
|
||||||
|
# Execute /usr/bin/{passwd, chfn, chsh} and /usr/sbin/{useradd, vipw}.
|
||||||
|
corecmd_exec_bin(groupadd_t)
|
||||||
|
@@ -366,6 +371,11 @@ files_read_usr_files(passwd_t)
|
||||||
|
files_search_var(passwd_t)
|
||||||
|
files_dontaudit_search_pids(passwd_t)
|
||||||
|
files_relabel_etc_files(passwd_t)
|
||||||
|
+files_search_pids(passwd_t)
|
||||||
|
+files_create_var_run_dirs(passwd_t)
|
||||||
|
+files_delete_all_pids(passwd_t)
|
||||||
|
+allow passwd_t var_run_t:file *;
|
||||||
|
+allow passwd_t var_run_t:dir *;
|
||||||
|
|
||||||
|
term_search_ptys(passwd_t)
|
||||||
|
|
||||||
|
@@ -486,6 +496,12 @@ userdom_use_unpriv_users_fds(sysadm_passwd_t)
|
||||||
|
# on user home dir
|
||||||
|
userdom_dontaudit_search_user_home_content(sysadm_passwd_t)
|
||||||
|
|
||||||
|
+files_search_pids(sysadm_passwd_t)
|
||||||
|
+files_create_var_run_dirs(sysadm_passwd_t)
|
||||||
|
+files_delete_all_pids(sysadm_passwd_t)
|
||||||
|
+allow sysadm_passwd_t var_run_t:file *;
|
||||||
|
+allow sysadm_passwd_t var_run_t:dir *;
|
||||||
|
+
|
||||||
|
optional_policy(`
|
||||||
|
nscd_run(sysadm_passwd_t, sysadm_passwd_roles)
|
||||||
|
')
|
||||||
|
@@ -536,6 +552,10 @@ files_read_etc_runtime_files(useradd_t)
|
||||||
|
files_manage_etc_files(useradd_t)
|
||||||
|
files_create_var_lib_dirs(useradd_t)
|
||||||
|
files_rw_var_lib_dirs(useradd_t)
|
||||||
|
+files_search_pids(useradd_t)
|
||||||
|
+files_create_var_run_dirs(useradd_t)
|
||||||
|
+files_delete_all_pids(useradd_t)
|
||||||
|
+allow useradd_t var_run_t:file *;
|
||||||
|
|
||||||
|
fs_search_auto_mountpoints(useradd_t)
|
||||||
|
fs_getattr_xattr_fs(useradd_t)
|
||||||
248
booleans-minimum.conf
Normal file
248
booleans-minimum.conf
Normal file
@ -0,0 +1,248 @@
|
|||||||
|
# Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack.
|
||||||
|
#
|
||||||
|
allow_execmem = false
|
||||||
|
|
||||||
|
# Allow making a modified private filemapping executable (text relocation).
|
||||||
|
#
|
||||||
|
allow_execmod = false
|
||||||
|
|
||||||
|
# Allow making the stack executable via mprotect.Also requires allow_execmem.
|
||||||
|
#
|
||||||
|
allow_execstack = true
|
||||||
|
|
||||||
|
# Allow ftpd to read cifs directories.
|
||||||
|
#
|
||||||
|
allow_ftpd_use_cifs = false
|
||||||
|
|
||||||
|
# Allow ftpd to read nfs directories.
|
||||||
|
#
|
||||||
|
allow_ftpd_use_nfs = false
|
||||||
|
|
||||||
|
# Allow ftp servers to modify public filesused for public file transfer services.
|
||||||
|
#
|
||||||
|
allow_ftpd_anon_write = false
|
||||||
|
|
||||||
|
# Allow gssd to read temp directory.
|
||||||
|
#
|
||||||
|
allow_gssd_read_tmp = true
|
||||||
|
|
||||||
|
# Allow Apache to modify public filesused for public file transfer services.
|
||||||
|
#
|
||||||
|
allow_httpd_anon_write = false
|
||||||
|
|
||||||
|
# Allow Apache to use mod_auth_pam module
|
||||||
|
#
|
||||||
|
allow_httpd_mod_auth_pam = false
|
||||||
|
|
||||||
|
# Allow system to run with kerberos
|
||||||
|
#
|
||||||
|
allow_kerberos = true
|
||||||
|
|
||||||
|
# Allow rsync to modify public filesused for public file transfer services.
|
||||||
|
#
|
||||||
|
allow_rsync_anon_write = false
|
||||||
|
|
||||||
|
# Allow sasl to read shadow
|
||||||
|
#
|
||||||
|
allow_saslauthd_read_shadow = false
|
||||||
|
|
||||||
|
# Allow samba to modify public filesused for public file transfer services.
|
||||||
|
#
|
||||||
|
allow_smbd_anon_write = false
|
||||||
|
|
||||||
|
# Allow system to run with NIS
|
||||||
|
#
|
||||||
|
allow_ypbind = false
|
||||||
|
|
||||||
|
# Allow zebra to write it own configuration files
|
||||||
|
#
|
||||||
|
allow_zebra_write_config = false
|
||||||
|
|
||||||
|
# Enable extra rules in the cron domainto support fcron.
|
||||||
|
#
|
||||||
|
fcron_crond = false
|
||||||
|
|
||||||
|
#
|
||||||
|
# allow httpd to connect to mysql/posgresql
|
||||||
|
httpd_can_network_connect_db = false
|
||||||
|
|
||||||
|
#
|
||||||
|
# allow httpd to send dbus messages to avahi
|
||||||
|
httpd_dbus_avahi = true
|
||||||
|
|
||||||
|
#
|
||||||
|
# allow httpd to network relay
|
||||||
|
httpd_can_network_relay = false
|
||||||
|
|
||||||
|
# Allow httpd to use built in scripting (usually php)
|
||||||
|
#
|
||||||
|
httpd_builtin_scripting = true
|
||||||
|
|
||||||
|
# Allow http daemon to tcp connect
|
||||||
|
#
|
||||||
|
httpd_can_network_connect = false
|
||||||
|
|
||||||
|
# Allow httpd cgi support
|
||||||
|
#
|
||||||
|
httpd_enable_cgi = true
|
||||||
|
|
||||||
|
# Allow httpd to act as a FTP server bylistening on the ftp port.
|
||||||
|
#
|
||||||
|
httpd_enable_ftp_server = false
|
||||||
|
|
||||||
|
# Allow httpd to read home directories
|
||||||
|
#
|
||||||
|
httpd_enable_homedirs = false
|
||||||
|
|
||||||
|
# Run SSI execs in system CGI script domain.
|
||||||
|
#
|
||||||
|
httpd_ssi_exec = false
|
||||||
|
|
||||||
|
# Allow http daemon to communicate with the TTY
|
||||||
|
#
|
||||||
|
httpd_tty_comm = false
|
||||||
|
|
||||||
|
# Run CGI in the main httpd domain
|
||||||
|
#
|
||||||
|
httpd_unified = false
|
||||||
|
|
||||||
|
# Allow BIND to write the master zone files.Generally this is used for dynamic DNS.
|
||||||
|
#
|
||||||
|
named_write_master_zones = false
|
||||||
|
|
||||||
|
# Allow nfs to be exported read/write.
|
||||||
|
#
|
||||||
|
nfs_export_all_rw = true
|
||||||
|
|
||||||
|
# Allow nfs to be exported read only
|
||||||
|
#
|
||||||
|
nfs_export_all_ro = true
|
||||||
|
|
||||||
|
# Allow pppd to load kernel modules for certain modems
|
||||||
|
#
|
||||||
|
pppd_can_insmod = false
|
||||||
|
|
||||||
|
# Allow reading of default_t files.
|
||||||
|
#
|
||||||
|
read_default_t = false
|
||||||
|
|
||||||
|
# Allow samba to export user home directories.
|
||||||
|
#
|
||||||
|
samba_enable_home_dirs = false
|
||||||
|
|
||||||
|
# Allow squid to connect to all ports, not justHTTP, FTP, and Gopher ports.
|
||||||
|
#
|
||||||
|
squid_connect_any = false
|
||||||
|
|
||||||
|
# Support NFS home directories
|
||||||
|
#
|
||||||
|
use_nfs_home_dirs = true
|
||||||
|
|
||||||
|
# Support SAMBA home directories
|
||||||
|
#
|
||||||
|
use_samba_home_dirs = false
|
||||||
|
|
||||||
|
# Control users use of ping and traceroute
|
||||||
|
#
|
||||||
|
user_ping = false
|
||||||
|
|
||||||
|
# allow host key based authentication
|
||||||
|
#
|
||||||
|
allow_ssh_keysign = false
|
||||||
|
|
||||||
|
# Allow pppd to be run for a regular user
|
||||||
|
#
|
||||||
|
pppd_for_user = false
|
||||||
|
|
||||||
|
# Allow applications to read untrusted contentIf this is disallowed, Internet content hasto be manually relabeled for read access to be granted
|
||||||
|
#
|
||||||
|
read_untrusted_content = false
|
||||||
|
|
||||||
|
# Allow spamd to write to users homedirs
|
||||||
|
#
|
||||||
|
spamd_enable_home_dirs = false
|
||||||
|
|
||||||
|
# Allow regular users direct mouse access
|
||||||
|
#
|
||||||
|
user_direct_mouse = false
|
||||||
|
|
||||||
|
# Allow users to read system messages.
|
||||||
|
#
|
||||||
|
user_dmesg = false
|
||||||
|
|
||||||
|
# Allow user to r/w files on filesystemsthat do not have extended attributes (FAT, CDROM, FLOPPY)
|
||||||
|
#
|
||||||
|
user_rw_noexattrfile = false
|
||||||
|
|
||||||
|
# Allow users to run TCP servers (bind to ports and accept connection fromthe same domain and outside users) disabling this forces FTP passive modeand may change other protocols.
|
||||||
|
#
|
||||||
|
user_tcp_server = false
|
||||||
|
|
||||||
|
# Allow w to display everyone
|
||||||
|
#
|
||||||
|
user_ttyfile_stat = false
|
||||||
|
|
||||||
|
# Allow applications to write untrusted contentIf this is disallowed, no Internet contentwill be stored.
|
||||||
|
#
|
||||||
|
write_untrusted_content = false
|
||||||
|
|
||||||
|
# Allow all domains to talk to ttys
|
||||||
|
#
|
||||||
|
allow_daemons_use_tty = false
|
||||||
|
|
||||||
|
# Allow login domains to polyinstatiate directories
|
||||||
|
#
|
||||||
|
allow_polyinstantiation = false
|
||||||
|
|
||||||
|
# Allow all domains to dump core
|
||||||
|
#
|
||||||
|
allow_daemons_dump_core = true
|
||||||
|
|
||||||
|
# Allow samba to act as the domain controller
|
||||||
|
#
|
||||||
|
samba_domain_controller = false
|
||||||
|
|
||||||
|
# Allow samba to export user home directories.
|
||||||
|
#
|
||||||
|
samba_run_unconfined = false
|
||||||
|
|
||||||
|
# Allows XServer to execute writable memory
|
||||||
|
#
|
||||||
|
allow_xserver_execmem = false
|
||||||
|
|
||||||
|
# disallow guest accounts to execute files that they can create
|
||||||
|
#
|
||||||
|
allow_guest_exec_content = false
|
||||||
|
allow_xguest_exec_content = false
|
||||||
|
|
||||||
|
# Only allow browser to use the web
|
||||||
|
#
|
||||||
|
browser_confine_xguest=false
|
||||||
|
|
||||||
|
# Allow postfix locat to write to mail spool
|
||||||
|
#
|
||||||
|
allow_postfix_local_write_mail_spool=false
|
||||||
|
|
||||||
|
# Allow common users to read/write noexattrfile systems
|
||||||
|
#
|
||||||
|
user_rw_noexattrfile=true
|
||||||
|
|
||||||
|
# Allow qemu to connect fully to the network
|
||||||
|
#
|
||||||
|
qemu_full_network=true
|
||||||
|
|
||||||
|
# Allow nsplugin execmem/execstack for bad plugins
|
||||||
|
#
|
||||||
|
allow_nsplugin_execmem=true
|
||||||
|
|
||||||
|
# Allow unconfined domain to transition to confined domain
|
||||||
|
#
|
||||||
|
allow_unconfined_nsplugin_transition=true
|
||||||
|
|
||||||
|
# System uses init upstart program
|
||||||
|
#
|
||||||
|
init_upstart = true
|
||||||
|
|
||||||
|
# Allow mount to mount any file/dir
|
||||||
|
#
|
||||||
|
allow_mount_anyfile = true
|
||||||
6
booleans-mls.conf
Normal file
6
booleans-mls.conf
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
kerberos_enabled = true
|
||||||
|
mount_anyfile = true
|
||||||
|
polyinstantiation_enabled = true
|
||||||
|
ftpd_is_daemon = true
|
||||||
|
selinuxuser_ping = true
|
||||||
|
xserver_object_manager = true
|
||||||
24
booleans-targeted.conf
Normal file
24
booleans-targeted.conf
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
gssd_read_tmp = true
|
||||||
|
httpd_builtin_scripting = true
|
||||||
|
httpd_enable_cgi = true
|
||||||
|
kerberos_enabled = true
|
||||||
|
mount_anyfile = true
|
||||||
|
nfs_export_all_ro = true
|
||||||
|
nfs_export_all_rw = true
|
||||||
|
nscd_use_shm = true
|
||||||
|
openvpn_enable_homedirs = true
|
||||||
|
postfix_local_write_mail_spool=true
|
||||||
|
pppd_can_insmod = false
|
||||||
|
privoxy_connect_any = true
|
||||||
|
selinuxuser_direct_dri_enabled = true
|
||||||
|
selinuxuser_execmem = true
|
||||||
|
selinuxuser_execmod = true
|
||||||
|
selinuxuser_execstack = true
|
||||||
|
selinuxuser_rw_noexattrfile=true
|
||||||
|
selinuxuser_ping = true
|
||||||
|
squid_connect_any = true
|
||||||
|
telepathy_tcp_connect_generic_network_ports=true
|
||||||
|
unconfined_chrome_sandbox_transition=true
|
||||||
|
unconfined_mozilla_plugin_transition=true
|
||||||
|
xguest_exec_content = true
|
||||||
|
mozilla_plugin_can_network_connect = true
|
||||||
54
booleans.subs_dist
Normal file
54
booleans.subs_dist
Normal file
@ -0,0 +1,54 @@
|
|||||||
|
allow_auditadm_exec_content auditadm_exec_content
|
||||||
|
allow_console_login login_console_enabled
|
||||||
|
allow_cvs_read_shadow cvs_read_shadow
|
||||||
|
allow_daemons_dump_core daemons_dump_core
|
||||||
|
allow_daemons_use_tcp_wrapper daemons_use_tcp_wrapper
|
||||||
|
allow_daemons_use_tty daemons_use_tty
|
||||||
|
allow_domain_fd_use domain_fd_use
|
||||||
|
allow_execheap selinuxuser_execheap
|
||||||
|
allow_execmod selinuxuser_execmod
|
||||||
|
allow_execstack selinuxuser_execstack
|
||||||
|
allow_ftpd_anon_write ftpd_anon_write
|
||||||
|
allow_ftpd_full_access ftpd_full_access
|
||||||
|
allow_ftpd_use_cifs ftpd_use_cifs
|
||||||
|
allow_ftpd_use_nfs ftpd_use_nfs
|
||||||
|
allow_gssd_read_tmp gssd_read_tmp
|
||||||
|
allow_guest_exec_content guest_exec_content
|
||||||
|
allow_httpd_anon_write httpd_anon_write
|
||||||
|
allow_httpd_mod_auth_ntlm_winbind httpd_mod_auth_ntlm_winbind
|
||||||
|
allow_httpd_mod_auth_pam httpd_mod_auth_pam
|
||||||
|
allow_httpd_sys_script_anon_write httpd_sys_script_anon_write
|
||||||
|
allow_kerberos kerberos_enabled
|
||||||
|
allow_mplayer_execstack mplayer_execstack
|
||||||
|
allow_mount_anyfile mount_anyfile
|
||||||
|
allow_nfsd_anon_write nfsd_anon_write
|
||||||
|
allow_polyinstantiation polyinstantiation_enabled
|
||||||
|
allow_postfix_local_write_mail_spool postfix_local_write_mail_spool
|
||||||
|
allow_rsync_anon_write rsync_anon_write
|
||||||
|
allow_saslauthd_read_shadow saslauthd_read_shadow
|
||||||
|
allow_secadm_exec_content secadm_exec_content
|
||||||
|
allow_smbd_anon_write smbd_anon_write
|
||||||
|
allow_ssh_keysign ssh_keysign
|
||||||
|
allow_staff_exec_content staff_exec_content
|
||||||
|
allow_sysadm_exec_content sysadm_exec_content
|
||||||
|
allow_user_exec_content user_exec_content
|
||||||
|
allow_user_mysql_connect selinuxuser_mysql_connect_enabled
|
||||||
|
allow_user_postgresql_connect selinuxuser_postgresql_connect_enabled
|
||||||
|
allow_write_xshm xserver_clients_write_xshm
|
||||||
|
allow_xguest_exec_content xguest_exec_content
|
||||||
|
allow_xserver_execmem xserver_execmem
|
||||||
|
allow_ypbind nis_enabled
|
||||||
|
allow_zebra_write_config zebra_write_config
|
||||||
|
user_direct_dri selinuxuser_direct_dri_enabled
|
||||||
|
user_ping selinuxuser_ping
|
||||||
|
user_share_music selinuxuser_share_music
|
||||||
|
user_tcp_server selinuxuser_tcp_server
|
||||||
|
sepgsql_enable_pitr_implementation postgresql_can_rsync
|
||||||
|
sepgsql_enable_users_ddl postgresql_selinux_users_ddl
|
||||||
|
sepgsql_transmit_client_label postgresql_selinux_transmit_client_label
|
||||||
|
sepgsql_unconfined_dbadm postgresql_selinux_unconfined_dbadm
|
||||||
|
clamd_use_jit antivirus_use_jit
|
||||||
|
amavis_use_jit antivirus_use_jit
|
||||||
|
logwatch_can_sendmail logwatch_can_network_connect_mail
|
||||||
|
puppet_manage_all_files puppetagent_manage_all_files
|
||||||
|
virt_sandbox_use_nfs virt_use_nfs
|
||||||
15
bugfix-add_syslogd_t_domtrans_logrotate.patch
Normal file
15
bugfix-add_syslogd_t_domtrans_logrotate.patch
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
|
||||||
|
index c524b01..93c5b94 100644
|
||||||
|
--- a/policy/modules/system/logging.te
|
||||||
|
+++ b/policy/modules/system/logging.te
|
||||||
|
@@ -700,6 +700,10 @@ optional_policy(`
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
+ logrotate_domtrans(syslogd_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
udev_read_db(syslogd_t)
|
||||||
|
')
|
||||||
|
|
||||||
BIN
container-selinux.tgz
Normal file
BIN
container-selinux.tgz
Normal file
Binary file not shown.
14
customizable_types
Normal file
14
customizable_types
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
container_file_t
|
||||||
|
sandbox_file_t
|
||||||
|
svirt_image_t
|
||||||
|
svirt_home_t
|
||||||
|
svirt_sandbox_file_t
|
||||||
|
virt_content_t
|
||||||
|
httpd_user_htaccess_t
|
||||||
|
httpd_user_script_exec_t
|
||||||
|
httpd_user_rw_content_t
|
||||||
|
httpd_user_ra_content_t
|
||||||
|
httpd_user_content_t
|
||||||
|
git_session_content_t
|
||||||
|
home_bin_t
|
||||||
|
user_tty_device_t
|
||||||
20
file_contexts.subs_dist
Normal file
20
file_contexts.subs_dist
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
/run /var/run
|
||||||
|
/run/lock /var/lock
|
||||||
|
/run/systemd/system /usr/lib/systemd/system
|
||||||
|
/run/systemd/generator /usr/lib/systemd/system
|
||||||
|
/run/systemd/generator.late /usr/lib/systemd/system
|
||||||
|
/lib /usr/lib
|
||||||
|
/lib64 /usr/lib
|
||||||
|
/usr/lib64 /usr/lib
|
||||||
|
/usr/local/lib64 /usr/lib
|
||||||
|
/usr/local/lib32 /usr/lib
|
||||||
|
/etc/systemd/system /usr/lib/systemd/system
|
||||||
|
/var/lib/xguest/home /home
|
||||||
|
/var/named/chroot/usr/lib64 /usr/lib
|
||||||
|
/var/named/chroot/lib64 /usr/lib
|
||||||
|
/var/home /home
|
||||||
|
/home-inst /home
|
||||||
|
/home/home-inst /home
|
||||||
|
/var/roothome /root
|
||||||
|
/sbin /usr/sbin
|
||||||
|
/sysroot/tmp /tmp
|
||||||
380
modules-mls-base.conf
Normal file
380
modules-mls-base.conf
Normal file
@ -0,0 +1,380 @@
|
|||||||
|
# Layer: kernel
|
||||||
|
# Module: bootloader
|
||||||
|
#
|
||||||
|
# Policy for the kernel modules, kernel image, and bootloader.
|
||||||
|
#
|
||||||
|
bootloader = module
|
||||||
|
|
||||||
|
# Layer: kernel
|
||||||
|
# Module: corenetwork
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy controlling access to network objects
|
||||||
|
#
|
||||||
|
corenetwork = base
|
||||||
|
|
||||||
|
# Layer: admin
|
||||||
|
# Module: dmesg
|
||||||
|
#
|
||||||
|
# Policy for dmesg.
|
||||||
|
#
|
||||||
|
dmesg = module
|
||||||
|
|
||||||
|
# Layer: admin
|
||||||
|
# Module: netutils
|
||||||
|
#
|
||||||
|
# Network analysis utilities
|
||||||
|
#
|
||||||
|
netutils = module
|
||||||
|
|
||||||
|
# Layer: admin
|
||||||
|
# Module: sudo
|
||||||
|
#
|
||||||
|
# Execute a command with a substitute user
|
||||||
|
#
|
||||||
|
sudo = module
|
||||||
|
|
||||||
|
# Layer: admin
|
||||||
|
# Module: su
|
||||||
|
#
|
||||||
|
# Run shells with substitute user and group
|
||||||
|
#
|
||||||
|
su = module
|
||||||
|
|
||||||
|
# Layer: admin
|
||||||
|
# Module: usermanage
|
||||||
|
#
|
||||||
|
# Policy for managing user accounts.
|
||||||
|
#
|
||||||
|
usermanage = module
|
||||||
|
|
||||||
|
# Layer: apps
|
||||||
|
# Module: seunshare
|
||||||
|
#
|
||||||
|
# seunshare executable
|
||||||
|
#
|
||||||
|
seunshare = module
|
||||||
|
|
||||||
|
# Layer: kernel
|
||||||
|
# Module: corecommands
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Core policy for shells, and generic programs
|
||||||
|
# in /bin, /sbin, /usr/bin, and /usr/sbin.
|
||||||
|
#
|
||||||
|
corecommands = base
|
||||||
|
|
||||||
|
# Module: devices
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Device nodes and interfaces for many basic system devices.
|
||||||
|
#
|
||||||
|
devices = base
|
||||||
|
|
||||||
|
# Module: domain
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Core policy for domains.
|
||||||
|
#
|
||||||
|
domain = base
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: userdomain
|
||||||
|
#
|
||||||
|
# Policy for user domains
|
||||||
|
#
|
||||||
|
userdomain = module
|
||||||
|
|
||||||
|
# Module: files
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Basic filesystem types and interfaces.
|
||||||
|
#
|
||||||
|
files = base
|
||||||
|
|
||||||
|
# Module: filesystem
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy for filesystems.
|
||||||
|
#
|
||||||
|
filesystem = base
|
||||||
|
|
||||||
|
# Module: kernel
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
|
||||||
|
#
|
||||||
|
kernel = base
|
||||||
|
|
||||||
|
# Module: mcs
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# MultiCategory security policy
|
||||||
|
#
|
||||||
|
mcs = base
|
||||||
|
|
||||||
|
# Module: mls
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Multilevel security policy
|
||||||
|
#
|
||||||
|
mls = base
|
||||||
|
|
||||||
|
# Module: selinux
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy for kernel security interface, in particular, selinuxfs.
|
||||||
|
#
|
||||||
|
selinux = base
|
||||||
|
|
||||||
|
# Layer: kernel
|
||||||
|
# Module: storage
|
||||||
|
#
|
||||||
|
# Policy controlling access to storage devices
|
||||||
|
#
|
||||||
|
storage = base
|
||||||
|
|
||||||
|
# Module: terminal
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy for terminals.
|
||||||
|
#
|
||||||
|
terminal = base
|
||||||
|
|
||||||
|
# Layer: kernel
|
||||||
|
# Module: ubac
|
||||||
|
#
|
||||||
|
#
|
||||||
|
#
|
||||||
|
ubac = base
|
||||||
|
|
||||||
|
# Layer: kernel
|
||||||
|
# Module: unlabelednet
|
||||||
|
#
|
||||||
|
# The unlabelednet module.
|
||||||
|
#
|
||||||
|
unlabelednet = module
|
||||||
|
|
||||||
|
# Layer: role
|
||||||
|
# Module: auditadm
|
||||||
|
#
|
||||||
|
# auditadm account on tty logins
|
||||||
|
#
|
||||||
|
auditadm = module
|
||||||
|
|
||||||
|
# Layer: role
|
||||||
|
# Module: logadm
|
||||||
|
#
|
||||||
|
# Minimally prived root role for managing logging system
|
||||||
|
#
|
||||||
|
logadm = module
|
||||||
|
|
||||||
|
# Layer: role
|
||||||
|
# Module: secadm
|
||||||
|
#
|
||||||
|
# secadm account on tty logins
|
||||||
|
#
|
||||||
|
secadm = module
|
||||||
|
|
||||||
|
# Layer:role
|
||||||
|
# Module: staff
|
||||||
|
#
|
||||||
|
# admin account
|
||||||
|
#
|
||||||
|
staff = module
|
||||||
|
|
||||||
|
# Layer:role
|
||||||
|
# Module: sysadm_secadm
|
||||||
|
#
|
||||||
|
# System Administrator with Security Admin rules
|
||||||
|
#
|
||||||
|
sysadm_secadm = module
|
||||||
|
|
||||||
|
# Layer:role
|
||||||
|
# Module: sysadm
|
||||||
|
#
|
||||||
|
# System Administrator
|
||||||
|
#
|
||||||
|
sysadm = module
|
||||||
|
|
||||||
|
# Layer: role
|
||||||
|
# Module: unprivuser
|
||||||
|
#
|
||||||
|
# Minimally privs guest account on tty logins
|
||||||
|
#
|
||||||
|
unprivuser = module
|
||||||
|
|
||||||
|
# Layer: services
|
||||||
|
# Module: postgresql
|
||||||
|
#
|
||||||
|
# PostgreSQL relational database
|
||||||
|
#
|
||||||
|
postgresql = module
|
||||||
|
|
||||||
|
# Layer: services
|
||||||
|
# Module: ssh
|
||||||
|
#
|
||||||
|
# Secure shell client and server policy.
|
||||||
|
#
|
||||||
|
ssh = module
|
||||||
|
|
||||||
|
# Layer: services
|
||||||
|
# Module: xserver
|
||||||
|
#
|
||||||
|
# X windows login display manager
|
||||||
|
#
|
||||||
|
xserver = module
|
||||||
|
|
||||||
|
# Module: application
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Defines attributs and interfaces for all user applications
|
||||||
|
#
|
||||||
|
application = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: authlogin
|
||||||
|
#
|
||||||
|
# Common policy for authentication and user login.
|
||||||
|
#
|
||||||
|
authlogin = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: clock
|
||||||
|
#
|
||||||
|
# Policy for reading and setting the hardware clock.
|
||||||
|
#
|
||||||
|
clock = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: fstools
|
||||||
|
#
|
||||||
|
# Tools for filesystem management, such as mkfs and fsck.
|
||||||
|
#
|
||||||
|
fstools = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: getty
|
||||||
|
#
|
||||||
|
# Policy for getty.
|
||||||
|
#
|
||||||
|
getty = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: hostname
|
||||||
|
#
|
||||||
|
# Policy for changing the system host name.
|
||||||
|
#
|
||||||
|
hostname = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: init
|
||||||
|
#
|
||||||
|
# System initialization programs (init and init scripts).
|
||||||
|
#
|
||||||
|
init = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: ipsec
|
||||||
|
#
|
||||||
|
# TCP/IP encryption
|
||||||
|
#
|
||||||
|
ipsec = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: iptables
|
||||||
|
#
|
||||||
|
# Policy for iptables.
|
||||||
|
#
|
||||||
|
iptables = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: libraries
|
||||||
|
#
|
||||||
|
# Policy for system libraries.
|
||||||
|
#
|
||||||
|
libraries = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: locallogin
|
||||||
|
#
|
||||||
|
# Policy for local logins.
|
||||||
|
#
|
||||||
|
locallogin = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: logging
|
||||||
|
#
|
||||||
|
# Policy for the kernel message logger and system logging daemon.
|
||||||
|
#
|
||||||
|
logging = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: lvm
|
||||||
|
#
|
||||||
|
# Policy for logical volume management programs.
|
||||||
|
#
|
||||||
|
lvm = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: miscfiles
|
||||||
|
#
|
||||||
|
# Miscelaneous files.
|
||||||
|
#
|
||||||
|
miscfiles = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: modutils
|
||||||
|
#
|
||||||
|
# Policy for kernel module utilities
|
||||||
|
#
|
||||||
|
modutils = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: mount
|
||||||
|
#
|
||||||
|
# Policy for mount.
|
||||||
|
#
|
||||||
|
mount = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: netlabel
|
||||||
|
#
|
||||||
|
# Basic netlabel types and interfaces.
|
||||||
|
#
|
||||||
|
netlabel = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: selinuxutil
|
||||||
|
#
|
||||||
|
# Policy for SELinux policy and userland applications.
|
||||||
|
#
|
||||||
|
selinuxutil = module
|
||||||
|
|
||||||
|
# Module: setrans
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy for setrans
|
||||||
|
#
|
||||||
|
setrans = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: sysnetwork
|
||||||
|
#
|
||||||
|
# Policy for network configuration: ifconfig and dhcp client.
|
||||||
|
#
|
||||||
|
sysnetwork = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: systemd
|
||||||
|
#
|
||||||
|
# Policy for systemd components
|
||||||
|
#
|
||||||
|
systemd = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: udev
|
||||||
|
#
|
||||||
|
# Policy for udev.
|
||||||
|
#
|
||||||
|
udev = module
|
||||||
1574
modules-mls-contrib.conf
Normal file
1574
modules-mls-contrib.conf
Normal file
File diff suppressed because it is too large
Load Diff
400
modules-targeted-base.conf
Normal file
400
modules-targeted-base.conf
Normal file
@ -0,0 +1,400 @@
|
|||||||
|
# Layer: kernel
|
||||||
|
# Module: bootloader
|
||||||
|
#
|
||||||
|
# Policy for the kernel modules, kernel image, and bootloader.
|
||||||
|
#
|
||||||
|
bootloader = module
|
||||||
|
|
||||||
|
# Layer: kernel
|
||||||
|
# Module: corecommands
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Core policy for shells, and generic programs
|
||||||
|
# in /bin, /sbin, /usr/bin, and /usr/sbin.
|
||||||
|
#
|
||||||
|
corecommands = base
|
||||||
|
|
||||||
|
# Layer: kernel
|
||||||
|
# Module: corenetwork
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy controlling access to network objects
|
||||||
|
#
|
||||||
|
corenetwork = base
|
||||||
|
|
||||||
|
# Layer: admin
|
||||||
|
# Module: dmesg
|
||||||
|
#
|
||||||
|
# Policy for dmesg.
|
||||||
|
#
|
||||||
|
dmesg = module
|
||||||
|
|
||||||
|
# Layer: admin
|
||||||
|
# Module: netutils
|
||||||
|
#
|
||||||
|
# Network analysis utilities
|
||||||
|
#
|
||||||
|
netutils = module
|
||||||
|
|
||||||
|
# Layer: admin
|
||||||
|
# Module: sudo
|
||||||
|
#
|
||||||
|
# Execute a command with a substitute user
|
||||||
|
#
|
||||||
|
sudo = module
|
||||||
|
|
||||||
|
# Layer: admin
|
||||||
|
# Module: su
|
||||||
|
#
|
||||||
|
# Run shells with substitute user and group
|
||||||
|
#
|
||||||
|
su = module
|
||||||
|
|
||||||
|
# Layer: admin
|
||||||
|
# Module: usermanage
|
||||||
|
#
|
||||||
|
# Policy for managing user accounts.
|
||||||
|
#
|
||||||
|
usermanage = module
|
||||||
|
|
||||||
|
# Layer: apps
|
||||||
|
# Module: seunshare
|
||||||
|
#
|
||||||
|
# seunshare executable
|
||||||
|
#
|
||||||
|
seunshare = module
|
||||||
|
|
||||||
|
# Module: devices
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Device nodes and interfaces for many basic system devices.
|
||||||
|
#
|
||||||
|
devices = base
|
||||||
|
|
||||||
|
# Module: domain
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Core policy for domains.
|
||||||
|
#
|
||||||
|
domain = base
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: userdomain
|
||||||
|
#
|
||||||
|
# Policy for user domains
|
||||||
|
#
|
||||||
|
userdomain = module
|
||||||
|
|
||||||
|
# Module: files
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Basic filesystem types and interfaces.
|
||||||
|
#
|
||||||
|
files = base
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: miscfiles
|
||||||
|
#
|
||||||
|
# Miscelaneous files.
|
||||||
|
#
|
||||||
|
miscfiles = module
|
||||||
|
|
||||||
|
# Module: filesystem
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy for filesystems.
|
||||||
|
#
|
||||||
|
filesystem = base
|
||||||
|
|
||||||
|
# Module: kernel
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy for kernel threads, proc filesystem,and unlabeled processes and objects.
|
||||||
|
#
|
||||||
|
kernel = base
|
||||||
|
|
||||||
|
# Module: mcs
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# MultiCategory security policy
|
||||||
|
#
|
||||||
|
mcs = base
|
||||||
|
|
||||||
|
# Module: mls
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Multilevel security policy
|
||||||
|
#
|
||||||
|
mls = base
|
||||||
|
|
||||||
|
# Module: selinux
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy for kernel security interface, in particular, selinuxfs.
|
||||||
|
#
|
||||||
|
selinux = base
|
||||||
|
|
||||||
|
# Layer: kernel
|
||||||
|
# Module: storage
|
||||||
|
#
|
||||||
|
# Policy controlling access to storage devices
|
||||||
|
#
|
||||||
|
storage = base
|
||||||
|
|
||||||
|
# Module: terminal
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy for terminals.
|
||||||
|
#
|
||||||
|
terminal = base
|
||||||
|
|
||||||
|
# Layer: kernel
|
||||||
|
# Module: ubac
|
||||||
|
#
|
||||||
|
#
|
||||||
|
#
|
||||||
|
ubac = base
|
||||||
|
|
||||||
|
# Layer: kernel
|
||||||
|
# Module: unconfined
|
||||||
|
#
|
||||||
|
# The unlabelednet module.
|
||||||
|
#
|
||||||
|
unlabelednet = module
|
||||||
|
|
||||||
|
# Layer: role
|
||||||
|
# Module: auditadm
|
||||||
|
#
|
||||||
|
# auditadm account on tty logins
|
||||||
|
#
|
||||||
|
auditadm = module
|
||||||
|
|
||||||
|
# Layer: role
|
||||||
|
# Module: logadm
|
||||||
|
#
|
||||||
|
# Minimally prived root role for managing logging system
|
||||||
|
#
|
||||||
|
logadm = module
|
||||||
|
|
||||||
|
# Layer: role
|
||||||
|
# Module: secadm
|
||||||
|
#
|
||||||
|
# secadm account on tty logins
|
||||||
|
#
|
||||||
|
secadm = module
|
||||||
|
|
||||||
|
# Layer:role
|
||||||
|
# Module: sysadm_secadm
|
||||||
|
#
|
||||||
|
# System Administrator with Security Admin rules
|
||||||
|
#
|
||||||
|
sysadm_secadm = module
|
||||||
|
|
||||||
|
# Module: staff
|
||||||
|
#
|
||||||
|
# admin account
|
||||||
|
#
|
||||||
|
staff = module
|
||||||
|
|
||||||
|
# Layer:role
|
||||||
|
# Module: sysadm
|
||||||
|
#
|
||||||
|
# System Administrator
|
||||||
|
#
|
||||||
|
sysadm = module
|
||||||
|
|
||||||
|
# Layer: role
|
||||||
|
# Module: unconfineduser
|
||||||
|
#
|
||||||
|
# The unconfined user domain.
|
||||||
|
#
|
||||||
|
unconfineduser = module
|
||||||
|
|
||||||
|
# Layer: role
|
||||||
|
# Module: unprivuser
|
||||||
|
#
|
||||||
|
# Minimally privs guest account on tty logins
|
||||||
|
#
|
||||||
|
unprivuser = module
|
||||||
|
|
||||||
|
# Layer: services
|
||||||
|
# Module: postgresql
|
||||||
|
#
|
||||||
|
# PostgreSQL relational database
|
||||||
|
#
|
||||||
|
postgresql = module
|
||||||
|
|
||||||
|
# Layer: services
|
||||||
|
# Module: ssh
|
||||||
|
#
|
||||||
|
# Secure shell client and server policy.
|
||||||
|
#
|
||||||
|
ssh = module
|
||||||
|
|
||||||
|
# Layer: services
|
||||||
|
# Module: xserver
|
||||||
|
#
|
||||||
|
# X windows login display manager
|
||||||
|
#
|
||||||
|
xserver = module
|
||||||
|
|
||||||
|
# Module: application
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Defines attributs and interfaces for all user applications
|
||||||
|
#
|
||||||
|
application = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: authlogin
|
||||||
|
#
|
||||||
|
# Common policy for authentication and user login.
|
||||||
|
#
|
||||||
|
authlogin = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: clock
|
||||||
|
#
|
||||||
|
# Policy for reading and setting the hardware clock.
|
||||||
|
#
|
||||||
|
clock = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: fstools
|
||||||
|
#
|
||||||
|
# Tools for filesystem management, such as mkfs and fsck.
|
||||||
|
#
|
||||||
|
fstools = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: getty
|
||||||
|
#
|
||||||
|
# Policy for getty.
|
||||||
|
#
|
||||||
|
getty = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: hostname
|
||||||
|
#
|
||||||
|
# Policy for changing the system host name.
|
||||||
|
#
|
||||||
|
hostname = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: init
|
||||||
|
#
|
||||||
|
# System initialization programs (init and init scripts).
|
||||||
|
#
|
||||||
|
init = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: ipsec
|
||||||
|
#
|
||||||
|
# TCP/IP encryption
|
||||||
|
#
|
||||||
|
ipsec = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: iptables
|
||||||
|
#
|
||||||
|
# Policy for iptables.
|
||||||
|
#
|
||||||
|
iptables = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: libraries
|
||||||
|
#
|
||||||
|
# Policy for system libraries.
|
||||||
|
#
|
||||||
|
libraries = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: locallogin
|
||||||
|
#
|
||||||
|
# Policy for local logins.
|
||||||
|
#
|
||||||
|
locallogin = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: logging
|
||||||
|
#
|
||||||
|
# Policy for the kernel message logger and system logging daemon.
|
||||||
|
#
|
||||||
|
logging = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: lvm
|
||||||
|
#
|
||||||
|
# Policy for logical volume management programs.
|
||||||
|
#
|
||||||
|
lvm = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: modutils
|
||||||
|
#
|
||||||
|
# Policy for kernel module utilities
|
||||||
|
#
|
||||||
|
modutils = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: mount
|
||||||
|
#
|
||||||
|
# Policy for mount.
|
||||||
|
#
|
||||||
|
mount = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: netlabel
|
||||||
|
#
|
||||||
|
# Basic netlabel types and interfaces.
|
||||||
|
#
|
||||||
|
netlabel = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: selinuxutil
|
||||||
|
#
|
||||||
|
# Policy for SELinux policy and userland applications.
|
||||||
|
#
|
||||||
|
selinuxutil = module
|
||||||
|
|
||||||
|
# Module: setrans
|
||||||
|
# Required in base
|
||||||
|
#
|
||||||
|
# Policy for setrans
|
||||||
|
#
|
||||||
|
setrans = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: sysnetwork
|
||||||
|
#
|
||||||
|
# Policy for network configuration: ifconfig and dhcp client.
|
||||||
|
#
|
||||||
|
sysnetwork = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: systemd
|
||||||
|
#
|
||||||
|
# Policy for systemd components
|
||||||
|
#
|
||||||
|
systemd = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: udev
|
||||||
|
#
|
||||||
|
# Policy for udev.
|
||||||
|
#
|
||||||
|
udev = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: unconfined
|
||||||
|
#
|
||||||
|
# The unconfined domain.
|
||||||
|
#
|
||||||
|
unconfined = module
|
||||||
|
|
||||||
|
# Layer: system
|
||||||
|
# Module: kdbus
|
||||||
|
#
|
||||||
|
# Policy for kdbus.
|
||||||
|
#
|
||||||
|
kdbus = module
|
||||||
2644
modules-targeted-contrib.conf
Normal file
2644
modules-targeted-contrib.conf
Normal file
File diff suppressed because it is too large
Load Diff
16
permissivedomains.cil
Normal file
16
permissivedomains.cil
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
(roleattributeset cil_gen_require system_r)
|
||||||
|
|
||||||
|
(optional permissivedomains_optional_1
|
||||||
|
(typeattributeset cil_gen_require tangd_t)
|
||||||
|
(typepermissive tangd_t)
|
||||||
|
)
|
||||||
|
|
||||||
|
(optional permissivedomains_optional_2
|
||||||
|
(typeattributeset cil_gen_require opafm_t)
|
||||||
|
(typepermissive opafm_t)
|
||||||
|
)
|
||||||
|
|
||||||
|
(optional permissivedomains_optional_3
|
||||||
|
(typeattributeset cil_gen_require boltd_t)
|
||||||
|
(typepermissive boltd_t)
|
||||||
|
)
|
||||||
169
rpm.macros
Normal file
169
rpm.macros
Normal file
@ -0,0 +1,169 @@
|
|||||||
|
# Copyright (C) 2017 Red Hat, Inc. All rights reserved.
|
||||||
|
#
|
||||||
|
# Author: Petr Lautrbach <plautrba@redhat.com>
|
||||||
|
# Author: Lukáš Vrabec <lvrabec@redhat.com>
|
||||||
|
#
|
||||||
|
# This program is free software; you can redistribute it and/or
|
||||||
|
# modify it under the terms of the GNU General Public License
|
||||||
|
# as published by the Free Software Foundation; either version 2
|
||||||
|
# of the License, or (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
# RPM macros for packages installing SELinux modules
|
||||||
|
|
||||||
|
%_selinux_policy_version SELINUXPOLICYVERSION
|
||||||
|
|
||||||
|
%_selinux_store_path SELINUXSTOREPATH
|
||||||
|
%_selinux_store_policy_path %{_selinux_store_path}/${_policytype}
|
||||||
|
|
||||||
|
%_file_context_file %{_sysconfdir}/selinux/${SELINUXTYPE}/contexts/files/file_contexts
|
||||||
|
%_file_context_file_pre %{_localstatedir}/lib/rpm-state/file_contexts.pre
|
||||||
|
|
||||||
|
%_file_custom_defined_booleans %{_selinux_store_policy_path}/rpmbooleans.custom
|
||||||
|
%_file_custom_defined_booleans_tmp %{_selinux_store_policy_path}/rpmbooleans.custom.tmp
|
||||||
|
|
||||||
|
# %selinux_requires
|
||||||
|
%selinux_requires \
|
||||||
|
Requires: selinux-policy >= %{_selinux_policy_version} \
|
||||||
|
BuildRequires: git \
|
||||||
|
BuildRequires: pkgconfig(systemd) \
|
||||||
|
BuildRequires: selinux-policy \
|
||||||
|
BuildRequires: selinux-policy-devel \
|
||||||
|
Requires(post): selinux-policy-base >= %{_selinux_policy_version} \
|
||||||
|
Requires(post): libselinux-utils \
|
||||||
|
Requires(post): policycoreutils \
|
||||||
|
%if 0%{?fedora} || 0%{?rhel} > 7\
|
||||||
|
Requires(post): policycoreutils-python-utils \
|
||||||
|
%else \
|
||||||
|
Requires(post): policycoreutils-python \
|
||||||
|
%endif \
|
||||||
|
%{nil}
|
||||||
|
|
||||||
|
# %selinux_modules_install [-s <policytype>] [-p <modulepriority>] module [module]...
|
||||||
|
%selinux_modules_install("s:p:") \
|
||||||
|
. /etc/selinux/config \
|
||||||
|
_policytype=%{-s*} \
|
||||||
|
if [ -z "${_policytype}" ]; then \
|
||||||
|
_policytype="targeted" \
|
||||||
|
fi \
|
||||||
|
if [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
|
||||||
|
%{_sbindir}/semodule -n -s ${_policytype} -X %{!-p:200}%{-p*} -i %* \
|
||||||
|
%{_sbindir}/selinuxenabled && %{_sbindir}/load_policy \
|
||||||
|
fi \
|
||||||
|
%{nil}
|
||||||
|
|
||||||
|
# %selinux_modules_uninstall [-s <policytype>] [-p <modulepriority>] module [module]...
|
||||||
|
%selinux_modules_uninstall("s:p:") \
|
||||||
|
. /etc/selinux/config \
|
||||||
|
_policytype=%{-s*} \
|
||||||
|
if [ -z "${_policytype}" ]; then \
|
||||||
|
_policytype="targeted" \
|
||||||
|
fi \
|
||||||
|
if [ $1 -eq 0 ]; then \
|
||||||
|
if [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
|
||||||
|
%{_sbindir}/semodule -n -X %{!-p:200}%{-p*} -s ${_policytype} -r %* &> /dev/null || : \
|
||||||
|
%{_sbindir}/selinuxenabled && %{_sbindir}/load_policy \
|
||||||
|
fi \
|
||||||
|
fi \
|
||||||
|
%{nil}
|
||||||
|
|
||||||
|
# %selinux_relabel_pre [-s <policytype>]
|
||||||
|
%selinux_relabel_pre("s:") \
|
||||||
|
. /etc/selinux/config \
|
||||||
|
_policytype=%{-s*} \
|
||||||
|
if [ -z "${_policytype}" ]; then \
|
||||||
|
_policytype="targeted" \
|
||||||
|
fi \
|
||||||
|
if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
|
||||||
|
[ -f %{_file_context_file_pre} ] || cp -f %{_file_context_file} %{_file_context_file_pre} \
|
||||||
|
fi \
|
||||||
|
%{nil}
|
||||||
|
|
||||||
|
|
||||||
|
# %selinux_relabel_post [-s <policytype>]
|
||||||
|
%selinux_relabel_post("s:") \
|
||||||
|
. /etc/selinux/config \
|
||||||
|
_policytype=%{-s*} \
|
||||||
|
if [ -z "${_policytype}" ]; then \
|
||||||
|
_policytype="targeted" \
|
||||||
|
fi \
|
||||||
|
if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
|
||||||
|
if [ -f %{_file_context_file_pre} ]; then \
|
||||||
|
%{_sbindir}/fixfiles -C %{_file_context_file_pre} restore &> /dev/null \
|
||||||
|
rm -f %{_file_context_file_pre} \
|
||||||
|
fi \
|
||||||
|
fi \
|
||||||
|
%{nil}
|
||||||
|
|
||||||
|
# %selinux_set_booleans [-s <policytype>] boolean [boolean]...
|
||||||
|
%selinux_set_booleans("s:") \
|
||||||
|
. /etc/selinux/config \
|
||||||
|
_policytype=%{-s*} \
|
||||||
|
if [ -z "${_policytype}" ]; then \
|
||||||
|
_policytype="targeted" \
|
||||||
|
fi \
|
||||||
|
if [ -d "%{_selinux_store_policy_path}" ]; then \
|
||||||
|
LOCAL_MODIFICATIONS=$(%{_sbindir}/semanage boolean -E) \
|
||||||
|
if [ ! -f %_file_custom_defined_booleans ]; then \
|
||||||
|
/bin/echo "# This file is managed by macros.selinux-policy. Do not edit it manually" > %_file_custom_defined_booleans \
|
||||||
|
fi \
|
||||||
|
semanage_import='' \
|
||||||
|
for boolean in %*; do \
|
||||||
|
boolean_name=${boolean%=*} \
|
||||||
|
boolean_value=${boolean#*=} \
|
||||||
|
boolean_local_string=$(grep "$boolean_name\$" <<<$LOCAL_MODIFICATIONS) \
|
||||||
|
if [ -n "$boolean_local_string" ]; then \
|
||||||
|
semanage_import="${semanage_import}\\nboolean -m -$boolean_value $boolean_name" \
|
||||||
|
boolean_customized_string=$(grep "$boolean_name\$" %_file_custom_defined_booleans | tail -n 1) \
|
||||||
|
if [ -n "$boolean_customized_string" ]; then \
|
||||||
|
/bin/echo $boolean_customized_string >> %_file_custom_defined_booleans \
|
||||||
|
else \
|
||||||
|
/bin/echo $boolean_local_string >> %_file_custom_defined_booleans \
|
||||||
|
fi \
|
||||||
|
else \
|
||||||
|
semanage_import="${semanage_import}\\nboolean -m -$boolean_value $boolean_name" \
|
||||||
|
boolean_default_value=$(LC_ALL=C %{_sbindir}/semanage boolean -l | grep "^$boolean_name " | sed 's/[^(]*([^,]*, *\\(on\\|off\\).*/\\1/') \
|
||||||
|
/bin/echo "boolean -m --$boolean_default_value $boolean_name" >> %_file_custom_defined_booleans \
|
||||||
|
fi \
|
||||||
|
done; \
|
||||||
|
if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
|
||||||
|
/bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" \
|
||||||
|
elif test -d /usr/share/selinux/"${_policytype}"/base.lst; then \
|
||||||
|
/bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" -N \
|
||||||
|
fi \
|
||||||
|
fi \
|
||||||
|
%{nil}
|
||||||
|
|
||||||
|
# %selinux_unset_booleans [-s <policytype>] boolean [boolean]...
|
||||||
|
%selinux_unset_booleans("s:") \
|
||||||
|
. /etc/selinux/config \
|
||||||
|
_policytype=%{-s*} \
|
||||||
|
if [ -z "${_policytype}" ]; then \
|
||||||
|
_policytype="targeted" \
|
||||||
|
fi \
|
||||||
|
if [ -d "%{_selinux_store_policy_path}" ]; then \
|
||||||
|
semanage_import='' \
|
||||||
|
for boolean in %*; do \
|
||||||
|
boolean_name=${boolean%=*} \
|
||||||
|
boolean_customized_string=$(grep "$boolean_name\$" %_file_custom_defined_booleans | tail -n 1) \
|
||||||
|
if [ -n "$boolean_customized_string" ]; then \
|
||||||
|
awk "/$boolean_customized_string/ && !f{f=1; next} 1" %_file_custom_defined_booleans > %_file_custom_defined_booleans_tmp && mv %_file_custom_defined_booleans_tmp %_file_custom_defined_booleans \
|
||||||
|
if ! grep -q "$boolean_name\$" %_file_custom_defined_booleans; then \
|
||||||
|
semanage_import="${semanage_import}\\n${boolean_customized_string}" \
|
||||||
|
fi \
|
||||||
|
fi \
|
||||||
|
done; \
|
||||||
|
if %{_sbindir}/selinuxenabled && [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
|
||||||
|
/bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" \
|
||||||
|
elif test -d /usr/share/selinux/"${_policytype}"/base.lst; then \
|
||||||
|
/bin/echo -e "$semanage_import" | %{_sbindir}/semanage import -S "${_policytype}" -N \
|
||||||
|
fi \
|
||||||
|
fi \
|
||||||
|
%{nil}
|
||||||
4
securetty_types-minimum
Normal file
4
securetty_types-minimum
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
console_device_t
|
||||||
|
sysadm_tty_device_t
|
||||||
|
user_tty_device_t
|
||||||
|
staff_tty_device_t
|
||||||
6
securetty_types-mls
Normal file
6
securetty_types-mls
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
console_device_t
|
||||||
|
sysadm_tty_device_t
|
||||||
|
user_tty_device_t
|
||||||
|
staff_tty_device_t
|
||||||
|
auditadm_tty_device_t
|
||||||
|
secureadm_tty_device_t
|
||||||
4
securetty_types-targeted
Normal file
4
securetty_types-targeted
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
console_device_t
|
||||||
|
sysadm_tty_device_t
|
||||||
|
user_tty_device_t
|
||||||
|
staff_tty_device_t
|
||||||
BIN
selinux-policy-38fa84d.tar.gz
Normal file
BIN
selinux-policy-38fa84d.tar.gz
Normal file
Binary file not shown.
BIN
selinux-policy-contrib-f9b7466.tar.gz
Normal file
BIN
selinux-policy-contrib-f9b7466.tar.gz
Normal file
Binary file not shown.
4
selinux-policy.conf
Normal file
4
selinux-policy.conf
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
z /sys/devices/system/cpu/online - - -
|
||||||
|
Z /sys/class/net - - -
|
||||||
|
z /sys/kernel/uevent_helper - - -
|
||||||
|
w /sys/fs/selinux/checkreqprot - - - - 0
|
||||||
655
selinux-policy.spec
Normal file
655
selinux-policy.spec
Normal file
@ -0,0 +1,655 @@
|
|||||||
|
%define distro redhat
|
||||||
|
%define polyinstatiate n
|
||||||
|
%define monolithic n
|
||||||
|
%define BUILD_DOC 1
|
||||||
|
%define BUILD_TARGETED 1
|
||||||
|
%define BUILD_MINIMUM 1
|
||||||
|
%define BUILD_MLS 1
|
||||||
|
%define POLICYVER 31
|
||||||
|
%define POLICYCOREUTILSVER 2.8
|
||||||
|
%define CHECKPOLICYVER 2.8
|
||||||
|
|
||||||
|
Summary: SELinux policy configuration
|
||||||
|
Name: selinux-policy
|
||||||
|
Version: 3.14.2
|
||||||
|
Release: 41
|
||||||
|
License: GPLv2+
|
||||||
|
|
||||||
|
Source0: selinux-policy-38fa84d.tar.gz
|
||||||
|
Source1: modules-targeted-base.conf
|
||||||
|
Source2: booleans-targeted.conf
|
||||||
|
Source3: Makefile.devel
|
||||||
|
Source4: setrans-targeted.conf
|
||||||
|
Source5: modules-mls-base.conf
|
||||||
|
Source6: booleans-mls.conf
|
||||||
|
Source8: setrans-mls.conf
|
||||||
|
Source14: securetty_types-targeted
|
||||||
|
Source15: securetty_types-mls
|
||||||
|
Source17: booleans-minimum.conf
|
||||||
|
Source18: setrans-minimum.conf
|
||||||
|
Source19: securetty_types-minimum
|
||||||
|
Source20: customizable_types
|
||||||
|
Source22: users-mls
|
||||||
|
Source23: users-targeted
|
||||||
|
Source25: users-minimum
|
||||||
|
Source26: file_contexts.subs_dist
|
||||||
|
Source27: selinux-policy.conf
|
||||||
|
Source28: permissivedomains.cil
|
||||||
|
Source29: selinux-policy-contrib-f9b7466.tar.gz
|
||||||
|
Source30: booleans.subs_dist
|
||||||
|
Source31: modules-targeted-contrib.conf
|
||||||
|
Source32: modules-mls-contrib.conf
|
||||||
|
Source35: container-selinux.tgz
|
||||||
|
Source102: rpm.macros
|
||||||
|
|
||||||
|
Patch9000: add_userman_access_run_dir.patch
|
||||||
|
Patch9001: add_syslogd_t_domtrans_logrotate.patch
|
||||||
|
Patch9002: bugfix-add_syslogd_t_domtrans_logrotate.patch
|
||||||
|
Patch9003: Fix-userdom_write_user_tmp_dirs-to-allow-caller-doma.patch
|
||||||
|
Patch9004: Fixing-range-for-ephemeral-ports-BZ-1518807.patch
|
||||||
|
Patch9005: Fix-userdom_admin_user_template-interface-by-adding-.patch
|
||||||
|
Patch9006: Fix-bug-in-userdom_restricted_xwindows_user_template.patch
|
||||||
|
|
||||||
|
BuildArch: noarch
|
||||||
|
BuildRequires: python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc
|
||||||
|
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}
|
||||||
|
Requires(post): /bin/awk /usr/bin/sha512sum
|
||||||
|
Requires: rpm-plugin-selinux
|
||||||
|
|
||||||
|
%description
|
||||||
|
SELinux Base package for SELinux Reference Policy - modular.
|
||||||
|
|
||||||
|
%define makeCmds() \
|
||||||
|
make UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} MLS_CATS=1024 MCS_CATS=1024 bare \
|
||||||
|
make UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} MLS_CATS=1024 MCS_CATS=1024 conf \
|
||||||
|
cp -f selinux_config/booleans-%1.conf ./policy/booleans.conf \
|
||||||
|
cp -f selinux_config/users-%1 ./policy/users \
|
||||||
|
|
||||||
|
%define makeModulesConf() \
|
||||||
|
cp -f selinux_config/modules-%1-%2.conf ./policy/modules-base.conf \
|
||||||
|
cp -f selinux_config/modules-%1-%2.conf ./policy/modules.conf \
|
||||||
|
if [ %3 == "contrib" ];then \
|
||||||
|
cp selinux_config/modules-%1-%3.conf ./policy/modules-contrib.conf; \
|
||||||
|
cat selinux_config/modules-%1-%3.conf >> ./policy/modules.conf; \
|
||||||
|
fi; \
|
||||||
|
|
||||||
|
%define installCmds() \
|
||||||
|
make UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} MLS_CATS=1024 MCS_CATS=1024 base.pp \
|
||||||
|
make validate UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} MLS_CATS=1024 MCS_CATS=1024 modules \
|
||||||
|
make UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} MLS_CATS=1024 MCS_CATS=1024 install \
|
||||||
|
make UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} MLS_CATS=1024 MCS_CATS=1024 install-appconfig \
|
||||||
|
make UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} MLS_CATS=1024 MCS_CATS=1024 SEMODULE="semodule -p %{buildroot} -X 100 " load \
|
||||||
|
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/logins \
|
||||||
|
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs \
|
||||||
|
install -m0644 selinux_config/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \
|
||||||
|
install -m0644 selinux_config/file_contexts.subs_dist %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files \
|
||||||
|
install -m0644 selinux_config/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \
|
||||||
|
install -m0644 selinux_config/customizable_types %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \
|
||||||
|
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.bin \
|
||||||
|
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.local \
|
||||||
|
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.local.bin \
|
||||||
|
cp %{SOURCE30} %{buildroot}%{_sysconfdir}/selinux/%1 \
|
||||||
|
rm -f %{buildroot}/%{_usr}/share/selinux/%1/*pp* \
|
||||||
|
/usr/bin/sha512sum %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} | cut -d' ' -f 1 > %{buildroot}%{_sysconfdir}/selinux/%1/.policy.sha512; \
|
||||||
|
rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/contexts/netfilter_contexts \
|
||||||
|
rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/modules/active/policy.kern \
|
||||||
|
rm -f %{buildroot}%{_sharedstatedir}/selinux/%1/active/*.linked \
|
||||||
|
%nil
|
||||||
|
|
||||||
|
%define fileList() \
|
||||||
|
%defattr(-,root,root) \
|
||||||
|
%{_datadir}/selinux/%1 \
|
||||||
|
%dir %{_sysconfdir}/selinux/%1 \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \
|
||||||
|
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/selinux/%1/seusers \
|
||||||
|
%dir %{_sysconfdir}/selinux/%1/logins \
|
||||||
|
%dir %{_sharedstatedir}/selinux/%1/active \
|
||||||
|
%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/semanage.read.LOCK \
|
||||||
|
%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/semanage.trans.LOCK \
|
||||||
|
%dir %attr(700,root,root) %dir %{_sharedstatedir}/selinux/%1/active/modules \
|
||||||
|
%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/modules/100/base \
|
||||||
|
%dir %{_sysconfdir}/selinux/%1/policy/ \
|
||||||
|
%verify(not md5 size mtime) %{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \
|
||||||
|
%{_sysconfdir}/selinux/%1/.policy.sha512 \
|
||||||
|
%dir %{_sysconfdir}/selinux/%1/contexts \
|
||||||
|
%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \
|
||||||
|
%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \
|
||||||
|
%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \
|
||||||
|
%config %{_sysconfdir}/selinux/%1/contexts/virtual_domain_context \
|
||||||
|
%config %{_sysconfdir}/selinux/%1/contexts/virtual_image_context \
|
||||||
|
%config %{_sysconfdir}/selinux/%1/contexts/lxc_contexts \
|
||||||
|
%config %{_sysconfdir}/selinux/%1/contexts/systemd_contexts \
|
||||||
|
%config %{_sysconfdir}/selinux/%1/contexts/sepgsql_contexts \
|
||||||
|
%config %{_sysconfdir}/selinux/%1/contexts/openssh_contexts \
|
||||||
|
%config %{_sysconfdir}/selinux/%1/contexts/snapperd_contexts \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \
|
||||||
|
%dir %{_sysconfdir}/selinux/%1/contexts/files \
|
||||||
|
%verify(not md5 size mtime) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
|
||||||
|
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.bin \
|
||||||
|
%verify(not md5 size mtime) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
|
||||||
|
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs.bin \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.local \
|
||||||
|
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.local.bin \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs \
|
||||||
|
%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs_dist \
|
||||||
|
%{_sysconfdir}/selinux/%1/booleans.subs_dist \
|
||||||
|
%config %{_sysconfdir}/selinux/%1/contexts/files/media \
|
||||||
|
%dir %{_sysconfdir}/selinux/%1/contexts/users \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u \
|
||||||
|
%{_sharedstatedir}/selinux/%1/active/commit_num \
|
||||||
|
%{_sharedstatedir}/selinux/%1/active/users_extra \
|
||||||
|
%{_sharedstatedir}/selinux/%1/active/homedir_template \
|
||||||
|
%{_sharedstatedir}/selinux/%1/active/seusers \
|
||||||
|
%{_sharedstatedir}/selinux/%1/active/file_contexts \
|
||||||
|
%{_sharedstatedir}/selinux/%1/active/policy.kern \
|
||||||
|
%ghost %{_sharedstatedir}/selinux/%1/active/policy.linked \
|
||||||
|
%ghost %{_sharedstatedir}/selinux/%1/active/seusers.linked \
|
||||||
|
%ghost %{_sharedstatedir}/selinux/%1/active/users_extra.linked \
|
||||||
|
%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/file_contexts.homedirs \
|
||||||
|
%nil
|
||||||
|
|
||||||
|
%define relabel() \
|
||||||
|
. %{_sysconfdir}/selinux/config; \
|
||||||
|
FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
|
||||||
|
/usr/sbin/selinuxenabled; \
|
||||||
|
if [ $? = 0 -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \
|
||||||
|
/sbin/fixfiles -C ${FILE_CONTEXT}.pre restore &> /dev/null > /dev/null; \
|
||||||
|
rm -f ${FILE_CONTEXT}.pre; \
|
||||||
|
fi; \
|
||||||
|
if /sbin/restorecon -e /run/media -R /root /var/log /var/run /etc/passwd* /etc/group* /etc/*shadow* 2> /dev/null;then \
|
||||||
|
continue; \
|
||||||
|
fi; \
|
||||||
|
|
||||||
|
%define preInstall() \
|
||||||
|
if [ $1 -ne 1 ] && [ -s /etc/selinux/config ]; then \
|
||||||
|
if [ -d %{_sharedstatedir}/selinux/%1/active/modules/100/ganesha ]; then \
|
||||||
|
%{_sbindir}/semodule -n -d ganesha; \
|
||||||
|
fi; \
|
||||||
|
. %{_sysconfdir}/selinux/config; \
|
||||||
|
FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
|
||||||
|
if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \
|
||||||
|
[ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \
|
||||||
|
fi; \
|
||||||
|
touch /etc/selinux/%1/.rebuild; \
|
||||||
|
if [ -e /etc/selinux/%1/.policy.sha512 ]; then \
|
||||||
|
POLICY_FILE=`ls /etc/selinux/%1/policy/policy.* | sort | head -1` \
|
||||||
|
sha512=`sha512sum $POLICY_FILE | cut -d ' ' -f 1`; \
|
||||||
|
checksha512=`cat /etc/selinux/%1/.policy.sha512`; \
|
||||||
|
if [ "$sha512" == "$checksha512" ] ; then \
|
||||||
|
rm /etc/selinux/%1/.rebuild; \
|
||||||
|
fi; \
|
||||||
|
fi; \
|
||||||
|
fi;
|
||||||
|
|
||||||
|
%define postInstall() \
|
||||||
|
. %{_sysconfdir}/selinux/config; \
|
||||||
|
if [ -e /etc/selinux/%2/.rebuild ]; then \
|
||||||
|
rm /etc/selinux/%2/.rebuild; \
|
||||||
|
/usr/sbin/semodule -B -n -s %2; \
|
||||||
|
fi; \
|
||||||
|
[ "${SELINUXTYPE}" == "%2" ] && selinuxenabled && load_policy; \
|
||||||
|
if [ %1 -eq 1 ]; then \
|
||||||
|
/sbin/restorecon -R /root /var/log /run /etc/passwd* /etc/group* /etc/*shadow* 2> /dev/null; \
|
||||||
|
else \
|
||||||
|
%relabel %2 \
|
||||||
|
fi;
|
||||||
|
|
||||||
|
%define modulesList() \
|
||||||
|
awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s ", $1 }' ./policy/modules-base.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules-base.lst \
|
||||||
|
awk '$1 !~ "/^#/" && $2 == "=" && $3 == "base" { printf "%%s ", $1 }' ./policy/modules-base.conf > %{buildroot}/%{_usr}/share/selinux/%1/base.lst \
|
||||||
|
if [ -e ./policy/modules-contrib.conf ];then \
|
||||||
|
awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s ", $1 }' ./policy/modules-contrib.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules-contrib.lst; \
|
||||||
|
fi;
|
||||||
|
|
||||||
|
%define nonBaseModulesList() \
|
||||||
|
contrib_modules=`cat %{buildroot}/%{_usr}/share/selinux/%1/modules-contrib.lst` \
|
||||||
|
base_modules=`cat %{buildroot}/%{_usr}/share/selinux/%1/modules-base.lst` \
|
||||||
|
for i in $contrib_modules $base_modules; do \
|
||||||
|
if [ $i != "sandbox" ];then \
|
||||||
|
echo "%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/modules/100/$i" >> %{buildroot}/%{_usr}/share/selinux/%1/nonbasemodules.lst \
|
||||||
|
fi; \
|
||||||
|
done;
|
||||||
|
|
||||||
|
%define installFactoryResetFiles() \
|
||||||
|
mkdir -p %{buildroot}%{_datadir}/selinux/%1/default \
|
||||||
|
cp -R --preserve=mode,ownership,timestamps,links %{buildroot}%{_sharedstatedir}/selinux/%1/active %{buildroot}%{_datadir}/selinux/%1/default/ \
|
||||||
|
find %{buildroot}%{_datadir}/selinux/%1/default/ -name hll | xargs rm \
|
||||||
|
find %{buildroot}%{_datadir}/selinux/%1/default/ -name lang_ext | xargs sed -i 's/pp/cil/' \
|
||||||
|
mkdir -p %{buildroot}/%{_libexecdir}/selinux/ \
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%setup -n %{name}-contrib-f9b7466780b5250bf94b5d40764277bc9c5b5f62 -q -b 29
|
||||||
|
tar -xf %{SOURCE35}
|
||||||
|
contrib_path=`pwd`
|
||||||
|
%autosetup -n %{name}-38fa84dc715893cab1cc76aa9c43ba325b153e10 -p1
|
||||||
|
|
||||||
|
refpolicy_path=`pwd`
|
||||||
|
cp $contrib_path/* $refpolicy_path/policy/modules/contrib
|
||||||
|
|
||||||
|
mkdir selinux_config
|
||||||
|
for i in %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} %{SOURCE8} %{SOURCE14} %{SOURCE15} %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} %{SOURCE22} %{SOURCE23} %{SOURCE25} %{SOURCE26} %{SOURCE31} %{SOURCE32}; do
|
||||||
|
cp $i selinux_config
|
||||||
|
done
|
||||||
|
|
||||||
|
%install
|
||||||
|
%{__rm} -fR %{buildroot}
|
||||||
|
mkdir -p %{buildroot}%{_sysconfdir}/selinux
|
||||||
|
mkdir -p %{buildroot}%{_sysconfdir}/sysconfig
|
||||||
|
touch %{buildroot}%{_sysconfdir}/selinux/config
|
||||||
|
touch %{buildroot}%{_sysconfdir}/sysconfig/selinux
|
||||||
|
mkdir -p %{buildroot}%{_usr}/lib/tmpfiles.d/
|
||||||
|
cp %{SOURCE27} %{buildroot}%{_usr}/lib/tmpfiles.d/
|
||||||
|
|
||||||
|
mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/
|
||||||
|
mkdir -p %{buildroot}%{_sharedstatedir}/selinux/{targeted,mls,minimum,modules}/
|
||||||
|
mkdir -p %{buildroot}%{_usr}/share/selinux/packages
|
||||||
|
|
||||||
|
make clean
|
||||||
|
%if %{BUILD_TARGETED}
|
||||||
|
cp %{SOURCE28} %{buildroot}/
|
||||||
|
%makeCmds targeted mcs n allow
|
||||||
|
%makeModulesConf targeted base contrib
|
||||||
|
%installCmds targeted mcs n allow
|
||||||
|
semodule -p %{buildroot} -X 100 -i %{buildroot}/permissivedomains.cil
|
||||||
|
rm -rf %{buildroot}/permissivedomains.cil
|
||||||
|
rm -rf %{buildroot}%{_sharedstatedir}/selinux/targeted/active/modules/100/sandbox
|
||||||
|
make UNK_PERMS=%4 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} MLS_CATS=1024 MCS_CATS=1024 sandbox.pp
|
||||||
|
mv sandbox.pp %{buildroot}/usr/share/selinux/packages/sandbox.pp
|
||||||
|
%modulesList targeted
|
||||||
|
%nonBaseModulesList targeted
|
||||||
|
%installFactoryResetFiles targeted
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%if %{BUILD_MINIMUM}
|
||||||
|
mkdir -p %{buildroot}%{_usr}/share/selinux/minimum
|
||||||
|
%makeCmds minimum mcs n allow
|
||||||
|
%makeModulesConf targeted base contrib
|
||||||
|
%installCmds minimum mcs n allow
|
||||||
|
rm -f %{buildroot}/%{_sysconfdir}/selinux/minimum/modules/active/modules/sandbox.pp
|
||||||
|
rm -rf %{buildroot}%{_sharedstatedir}/selinux/minimum/active/modules/100/sandbox
|
||||||
|
%modulesList minimum
|
||||||
|
%nonBaseModulesList minimum
|
||||||
|
%installFactoryResetFiles minimum
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%if %{BUILD_MLS}
|
||||||
|
%makeCmds mls mls n deny
|
||||||
|
%makeModulesConf mls base contrib
|
||||||
|
%installCmds mls mls n deny
|
||||||
|
%modulesList mls
|
||||||
|
%nonBaseModulesList mls
|
||||||
|
%installFactoryResetFiles mls
|
||||||
|
%endif
|
||||||
|
|
||||||
|
mkdir -p %{buildroot}%{_mandir}
|
||||||
|
cp -R man/* %{buildroot}%{_mandir}
|
||||||
|
make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name} MLS_CATS=1024 MCS_CATS=1024 install-docs
|
||||||
|
make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name} MLS_CATS=1024 MCS_CATS=1024 install-headers
|
||||||
|
mkdir %{buildroot}%{_usr}/share/selinux/devel/
|
||||||
|
mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include
|
||||||
|
install -m 644 selinux_config/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile
|
||||||
|
install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/
|
||||||
|
install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/
|
||||||
|
/usr/bin/sepolicy manpage -a -p %{buildroot}/usr/share/man/man8/ -w -r %{buildroot}
|
||||||
|
mkdir %{buildroot}%{_usr}/share/selinux/devel/html
|
||||||
|
mv %{buildroot}%{_usr}/share/man/man8/*.html %{buildroot}%{_usr}/share/selinux/devel/html
|
||||||
|
mv %{buildroot}%{_usr}/share/man/man8/style.css %{buildroot}%{_usr}/share/selinux/devel/html
|
||||||
|
|
||||||
|
mkdir -p %{buildroot}%{_rpmconfigdir}/macros.d
|
||||||
|
install -m 644 %{SOURCE102} %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy
|
||||||
|
sed -i 's/SELINUXPOLICYVERSION/%{version}-%{release}/' %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy
|
||||||
|
sed -i 's@SELINUXSTOREPATH@%{_sharedstatedir}/selinux@' %{buildroot}%{_rpmconfigdir}/macros.d/macros.selinux-policy
|
||||||
|
rm -rf selinux_config
|
||||||
|
|
||||||
|
%post
|
||||||
|
if [ ! -s /etc/selinux/config ]; then
|
||||||
|
echo "
|
||||||
|
# This file controls the state of SELinux on the system.
|
||||||
|
# SELINUX= can take one of these three values:
|
||||||
|
# enforcing - SELinux security policy is enforced.
|
||||||
|
# permissive - SELinux prints warnings instead of enforcing.
|
||||||
|
# disabled - No SELinux policy is loaded.
|
||||||
|
SELINUX=permissive
|
||||||
|
# SELINUXTYPE= can take one of these three values:
|
||||||
|
# targeted - Targeted processes are protected,
|
||||||
|
# minimum - Modification of targeted policy. Only selected processes are protected.
|
||||||
|
# mls - Multi Level Security protection.
|
||||||
|
SELINUXTYPE=targeted
|
||||||
|
|
||||||
|
" > /etc/selinux/config
|
||||||
|
|
||||||
|
ln -sf ../selinux/config /etc/sysconfig/selinux
|
||||||
|
restorecon /etc/selinux/config 2> /dev/null || :
|
||||||
|
else
|
||||||
|
. /etc/selinux/config
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%postun
|
||||||
|
if [ $1 = 0 ]; then
|
||||||
|
setenforce 0 2> /dev/null
|
||||||
|
if [ ! -s /etc/selinux/config ]; then
|
||||||
|
echo "SELINUX=disabled" > /etc/selinux/config
|
||||||
|
else
|
||||||
|
sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%files
|
||||||
|
%{!?_licensedir:%global license %%doc}
|
||||||
|
%license COPYING
|
||||||
|
%dir %{_usr}/share/selinux
|
||||||
|
%dir %{_usr}/share/selinux/packages
|
||||||
|
%dir %{_sysconfdir}/selinux
|
||||||
|
%ghost %config(noreplace) %{_sysconfdir}/selinux/config
|
||||||
|
%ghost %{_sysconfdir}/sysconfig/selinux
|
||||||
|
%{_usr}/lib/tmpfiles.d/selinux-policy.conf
|
||||||
|
%{_rpmconfigdir}/macros.d/macros.selinux-policy
|
||||||
|
|
||||||
|
%package sandbox
|
||||||
|
Summary: SELinux policy sandbox
|
||||||
|
Requires(pre): selinux-policy-base = %{version}-%{release} selinux-policy-targeted = %{version}-%{release}
|
||||||
|
|
||||||
|
%description sandbox
|
||||||
|
SELinux sandbox policy used for the policycoreutils-sandbox package
|
||||||
|
|
||||||
|
%post sandbox
|
||||||
|
rm -f /etc/selinux/*/modules/active/modules/sandbox.pp.disabled 2>/dev/null
|
||||||
|
rm -f %{_sharedstatedir}/selinux/*/active/modules/disabled/sandbox 2>/dev/null
|
||||||
|
semodule -n -X 100 -i /usr/share/selinux/packages/sandbox.pp
|
||||||
|
if /usr/sbin/selinuxenabled ; then
|
||||||
|
/usr/sbin/load_policy
|
||||||
|
fi;
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%preun sandbox
|
||||||
|
if [ $1 -eq 0 ] ; then
|
||||||
|
semodule -n -d sandbox 2>/dev/null
|
||||||
|
if /usr/sbin/selinuxenabled ; then
|
||||||
|
/usr/sbin/load_policy
|
||||||
|
fi;
|
||||||
|
fi;
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%files sandbox
|
||||||
|
%verify(not md5 size mtime) /usr/share/selinux/packages/sandbox.pp
|
||||||
|
|
||||||
|
%package devel
|
||||||
|
Summary: SELinux policy devel
|
||||||
|
Requires: selinux-policy = %{version}-%{release} m4 checkpolicy >= %{CHECKPOLICYVER} /usr/bin/make
|
||||||
|
Requires(post): policycoreutils-devel >= %{POLICYCOREUTILSVER}
|
||||||
|
|
||||||
|
%description devel
|
||||||
|
SELinux policy development and man page package
|
||||||
|
|
||||||
|
%post devel
|
||||||
|
selinuxenabled && /usr/bin/sepolgen-ifgen 2>/dev/null
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%files devel
|
||||||
|
%dir %{_usr}/share/selinux/devel
|
||||||
|
%dir %{_usr}/share/selinux/devel/include
|
||||||
|
%{_usr}/share/selinux/devel/include/*
|
||||||
|
%dir %{_usr}/share/selinux/devel/html
|
||||||
|
%{_usr}/share/selinux/devel/html/*html
|
||||||
|
%{_usr}/share/selinux/devel/html/*css
|
||||||
|
%{_usr}/share/selinux/devel/Makefile
|
||||||
|
%{_usr}/share/selinux/devel/example.*
|
||||||
|
%{_usr}/share/selinux/devel/policy.*
|
||||||
|
%ghost %{_sharedstatedir}/sepolgen/interface_info
|
||||||
|
|
||||||
|
%package help
|
||||||
|
Summary: SELinux policy documentation
|
||||||
|
Requires: selinux-policy = %{version}-%{release}
|
||||||
|
|
||||||
|
Provides: selinux-policy-doc
|
||||||
|
Obsoletes: selinux-policy-doc
|
||||||
|
|
||||||
|
%description help
|
||||||
|
SELinux policy documentation package
|
||||||
|
|
||||||
|
%files help
|
||||||
|
%{_mandir}/man*/*
|
||||||
|
%{_mandir}/ru/*/*
|
||||||
|
%doc %{_usr}/share/doc/%{name}
|
||||||
|
|
||||||
|
%if %{BUILD_TARGETED}
|
||||||
|
%package targeted
|
||||||
|
Summary: SELinux targeted base policy
|
||||||
|
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} coreutils selinux-policy = %{version}-%{release}
|
||||||
|
Requires: selinux-policy = %{version}-%{release}
|
||||||
|
|
||||||
|
Provides: selinux-policy-base = %{version}-%{release}
|
||||||
|
Obsoletes: selinux-policy-targeted-sources < 2
|
||||||
|
Obsoletes: mod_fcgid-selinux <= %{version}-%{release}
|
||||||
|
Obsoletes: cachefilesd-selinux <= 0.10-1
|
||||||
|
Conflicts: audispd-plugins <= 1.7.7-1
|
||||||
|
Conflicts: seedit
|
||||||
|
Conflicts: 389-ds-base < 1.2.7, 389-admin < 1.1.12
|
||||||
|
Conflicts: container-selinux < 2:1.12.1-22
|
||||||
|
|
||||||
|
%description targeted
|
||||||
|
SELinux Reference policy targeted base module.
|
||||||
|
|
||||||
|
%pre targeted
|
||||||
|
%preInstall targeted
|
||||||
|
|
||||||
|
%post targeted
|
||||||
|
%postInstall $1 targeted
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%postun targeted
|
||||||
|
if [ $1 = 0 ]; then
|
||||||
|
source /etc/selinux/config
|
||||||
|
if [ "$SELINUXTYPE" = "targeted" ]; then
|
||||||
|
setenforce 0 2> /dev/null
|
||||||
|
if [ ! -s /etc/selinux/config ]; then
|
||||||
|
echo "SELINUX=disabled" > /etc/selinux/config
|
||||||
|
else
|
||||||
|
sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%triggerin -- pcre
|
||||||
|
selinuxenabled && semodule -nB
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%triggerpostun -- selinux-policy-targeted < 3.12.1-74
|
||||||
|
rm -f /etc/selinux/*/modules/active/modules/sandbox.pp.disabled 2>/dev/null
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%triggerpostun targeted -- selinux-policy-targeted < 3.13.1-138
|
||||||
|
CR=$'\n'
|
||||||
|
INPUT=""
|
||||||
|
for i in `find /etc/selinux/targeted/modules/active/modules/ -name \*disabled`; do
|
||||||
|
module=`basename $i | sed 's/.pp.disabled//'`
|
||||||
|
if [ -d /var/lib/selinux/targeted/active/modules/100/$module ]; then
|
||||||
|
touch /var/lib/selinux/targeted/active/modules/disabled/$p
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
for i in `find /etc/selinux/targeted/modules/active/modules/ -name \*.pp`; do
|
||||||
|
INPUT="${INPUT}${CR}module -N -a $i"
|
||||||
|
done
|
||||||
|
for i in $(find /etc/selinux/targeted/modules/active -name \*.local); do
|
||||||
|
cp $i /var/lib/selinux/targeted/active
|
||||||
|
done
|
||||||
|
echo "$INPUT" | %{_sbindir}/semanage import -S targeted -N
|
||||||
|
if /usr/sbin/selinuxenabled ; then
|
||||||
|
/usr/sbin/load_policy
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%files targeted -f %{buildroot}/%{_usr}/share/selinux/targeted/nonbasemodules.lst
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/sysadm_u
|
||||||
|
%fileList targeted
|
||||||
|
%verify(not md5 size mtime) %{_sharedstatedir}/selinux/targeted/active/modules/100/permissivedomains
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%if %{BUILD_MINIMUM}
|
||||||
|
%package minimum
|
||||||
|
Summary: SELinux minimum base policy
|
||||||
|
Requires(pre): coreutils selinux-policy = %{version}-%{release}
|
||||||
|
Requires(post): policycoreutils-python-utils >= %{POLICYCOREUTILSVER}
|
||||||
|
Requires: selinux-policy = %{version}-%{release}
|
||||||
|
|
||||||
|
Provides: selinux-policy-base = %{version}-%{release}
|
||||||
|
Conflicts: seedit
|
||||||
|
Conflicts: container-selinux <= 1.9.0-9
|
||||||
|
|
||||||
|
%description minimum
|
||||||
|
SELinux Reference policy minimum base module.
|
||||||
|
|
||||||
|
%pre minimum
|
||||||
|
%preInstall minimum
|
||||||
|
if [ $1 -ne 1 ]; then
|
||||||
|
/usr/sbin/semodule -s minimum --list-modules=full | awk '{ if ($4 != "disabled") print $2; }' > /usr/share/selinux/minimum/instmodules.lst
|
||||||
|
fi
|
||||||
|
|
||||||
|
%post minimum
|
||||||
|
contribpackages=`cat /usr/share/selinux/minimum/modules-contrib.lst`
|
||||||
|
basepackages=`cat /usr/share/selinux/minimum/modules-base.lst`
|
||||||
|
if [ ! -d /var/lib/selinux/minimum/active/modules/disabled ]; then
|
||||||
|
mkdir /var/lib/selinux/minimum/active/modules/disabled
|
||||||
|
fi
|
||||||
|
if [ $1 -eq 1 ]; then
|
||||||
|
for p in $contribpackages; do
|
||||||
|
touch /var/lib/selinux/minimum/active/modules/disabled/$p
|
||||||
|
done
|
||||||
|
for p in $basepackages apache dbus inetd kerberos mta nis; do
|
||||||
|
rm -f /var/lib/selinux/minimum/active/modules/disabled/$p
|
||||||
|
done
|
||||||
|
/usr/sbin/semanage import -S minimum -f - << __eof
|
||||||
|
login -m -s unconfined_u -r s0-s0:c0.c1023 __default__
|
||||||
|
login -m -s unconfined_u -r s0-s0:c0.c1023 root
|
||||||
|
__eof
|
||||||
|
/sbin/restorecon -R /root /var/log /var/run 2> /dev/null
|
||||||
|
/usr/sbin/semodule -B -s minimum
|
||||||
|
else
|
||||||
|
instpackages=`cat /usr/share/selinux/minimum/instmodules.lst`
|
||||||
|
for p in $contribpackages; do
|
||||||
|
touch /var/lib/selinux/minimum/active/modules/disabled/$p
|
||||||
|
done
|
||||||
|
for p in $instpackages apache dbus inetd kerberos mta nis; do
|
||||||
|
rm -f /var/lib/selinux/minimum/active/modules/disabled/$p
|
||||||
|
done
|
||||||
|
/usr/sbin/semodule -B -s minimum
|
||||||
|
%relabel minimum
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%postun minimum
|
||||||
|
if [ $1 = 0 ]; then
|
||||||
|
source /etc/selinux/config
|
||||||
|
if [ "$SELINUXTYPE" = "minimum" ]; then
|
||||||
|
setenforce 0 2> /dev/null
|
||||||
|
if [ ! -s /etc/selinux/config ]; then
|
||||||
|
echo "SELINUX=disabled" > /etc/selinux/config
|
||||||
|
else
|
||||||
|
sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%triggerpostun minimum -- selinux-policy-minimum < 3.13.1-138
|
||||||
|
if [ `ls -A /var/lib/selinux/minimum/active/modules/disabled/` ]; then
|
||||||
|
rm -f /var/lib/selinux/minimum/active/modules/disabled/*
|
||||||
|
fi
|
||||||
|
CR=$'\n'
|
||||||
|
INPUT=""
|
||||||
|
for i in `find /etc/selinux/minimum/modules/active/modules/ -name \*disabled`; do
|
||||||
|
module=`basename $i | sed 's/.pp.disabled//'`
|
||||||
|
if [ -d /var/lib/selinux/minimum/active/modules/100/$module ]; then
|
||||||
|
touch /var/lib/selinux/minimum/active/modules/disabled/$p
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
for i in `find /etc/selinux/minimum/modules/active/modules/ -name \*.pp`; do
|
||||||
|
INPUT="${INPUT}${CR}module -N -a $i"
|
||||||
|
done
|
||||||
|
echo "$INPUT" | %{_sbindir}/semanage import -S minimum -N
|
||||||
|
if /usr/sbin/selinuxenabled ; then
|
||||||
|
/usr/sbin/load_policy
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%files minimum -f %{buildroot}/%{_usr}/share/selinux/minimum/nonbasemodules.lst
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/sysadm_u
|
||||||
|
%fileList minimum
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%if %{BUILD_MLS}
|
||||||
|
%package mls
|
||||||
|
Summary: SELinux mls base policy
|
||||||
|
Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd selinux-policy = %{version}-%{release}
|
||||||
|
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} coreutils
|
||||||
|
|
||||||
|
Provides: selinux-policy-base = %{version}-%{release}
|
||||||
|
Obsoletes: selinux-policy-mls-sources < 2
|
||||||
|
Conflicts: seedit
|
||||||
|
Conflicts: container-selinux <= 1.9.0-9
|
||||||
|
|
||||||
|
%description mls
|
||||||
|
SELinux Reference policy mls base module.
|
||||||
|
|
||||||
|
%pre mls
|
||||||
|
%preInstall mls
|
||||||
|
|
||||||
|
%post mls
|
||||||
|
%postInstall $1 mls
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%postun mls
|
||||||
|
if [ $1 = 0 ]; then
|
||||||
|
source /etc/selinux/config
|
||||||
|
if [ "$SELINUXTYPE" = "mls" ]; then
|
||||||
|
setenforce 0 2> /dev/null
|
||||||
|
if [ ! -s /etc/selinux/config ]; then
|
||||||
|
echo "SELINUX=disabled" > /etc/selinux/config
|
||||||
|
else
|
||||||
|
sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%triggerpostun mls -- selinux-policy-mls < 3.13.1-138
|
||||||
|
CR=$'\n'
|
||||||
|
INPUT=""
|
||||||
|
for i in `find /etc/selinux/mls/modules/active/modules/ -name \*disabled`; do
|
||||||
|
module=`basename $i | sed 's/.pp.disabled//'`
|
||||||
|
if [ -d /var/lib/selinux/mls/active/modules/100/$module ]; then
|
||||||
|
touch /var/lib/selinux/mls/active/modules/disabled/$p
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
for i in `find /etc/selinux/mls/modules/active/modules/ -name \*.pp`; do
|
||||||
|
INPUT="${INPUT}${CR}module -N -a $i"
|
||||||
|
done
|
||||||
|
echo "$INPUT" | %{_sbindir}/semanage import -S mls -N
|
||||||
|
if /usr/sbin/selinuxenabled ; then
|
||||||
|
/usr/sbin/load_policy
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
%files mls -f %{buildroot}/%{_usr}/share/selinux/mls/nonbasemodules.lst
|
||||||
|
%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u
|
||||||
|
%fileList mls
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%changelog
|
||||||
|
* Thu Sep 12 2019 openEuler Buildteam <buildteam@openeuler.org> - 3.14.2-41
|
||||||
|
- Package init
|
||||||
19
setrans-minimum.conf
Normal file
19
setrans-minimum.conf
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
#
|
||||||
|
# Multi-Category Security translation table for SELinux
|
||||||
|
#
|
||||||
|
# Uncomment the following to disable translation libary
|
||||||
|
# disable=1
|
||||||
|
#
|
||||||
|
# Objects can be categorized with 0-1023 categories defined by the admin.
|
||||||
|
# Objects can be in more than one category at a time.
|
||||||
|
# Categories are stored in the system as c0-c1023. Users can use this
|
||||||
|
# table to translate the categories into a more meaningful output.
|
||||||
|
# Examples:
|
||||||
|
# s0:c0=CompanyConfidential
|
||||||
|
# s0:c1=PatientRecord
|
||||||
|
# s0:c2=Unclassified
|
||||||
|
# s0:c3=TopSecret
|
||||||
|
# s0:c1,c3=CompanyConfidentialRedHat
|
||||||
|
s0=SystemLow
|
||||||
|
s0-s0:c0.c1023=SystemLow-SystemHigh
|
||||||
|
s0:c0.c1023=SystemHigh
|
||||||
52
setrans-mls.conf
Normal file
52
setrans-mls.conf
Normal file
@ -0,0 +1,52 @@
|
|||||||
|
#
|
||||||
|
# Multi-Level Security translation table for SELinux
|
||||||
|
#
|
||||||
|
# Uncomment the following to disable translation libary
|
||||||
|
# disable=1
|
||||||
|
#
|
||||||
|
# Objects can be labeled with one of 16 levels and be categorized with 0-1023
|
||||||
|
# categories defined by the admin.
|
||||||
|
# Objects can be in more than one category at a time.
|
||||||
|
# Users can modify this table to translate the MLS labels for different purpose.
|
||||||
|
#
|
||||||
|
# Assumptions: using below MLS labels.
|
||||||
|
# SystemLow
|
||||||
|
# SystemHigh
|
||||||
|
# Unclassified
|
||||||
|
# Secret with compartments A and B.
|
||||||
|
#
|
||||||
|
# SystemLow and SystemHigh
|
||||||
|
s0=SystemLow
|
||||||
|
s15:c0.c1023=SystemHigh
|
||||||
|
s0-s15:c0.c1023=SystemLow-SystemHigh
|
||||||
|
|
||||||
|
# Unclassified level
|
||||||
|
s1=Unclassified
|
||||||
|
|
||||||
|
# Secret level with compartments
|
||||||
|
s2=Secret
|
||||||
|
s2:c0=A
|
||||||
|
s2:c1=B
|
||||||
|
|
||||||
|
# ranges for Unclassified
|
||||||
|
s0-s1=SystemLow-Unclassified
|
||||||
|
s1-s2=Unclassified-Secret
|
||||||
|
s1-s15:c0.c1023=Unclassified-SystemHigh
|
||||||
|
|
||||||
|
# ranges for Secret with compartments
|
||||||
|
s0-s2=SystemLow-Secret
|
||||||
|
s0-s2:c0=SystemLow-Secret:A
|
||||||
|
s0-s2:c1=SystemLow-Secret:B
|
||||||
|
s0-s2:c0,c1=SystemLow-Secret:AB
|
||||||
|
s1-s2:c0=Unclassified-Secret:A
|
||||||
|
s1-s2:c1=Unclassified-Secret:B
|
||||||
|
s1-s2:c0,c1=Unclassified-Secret:AB
|
||||||
|
s2-s2:c0=Secret-Secret:A
|
||||||
|
s2-s2:c1=Secret-Secret:B
|
||||||
|
s2-s2:c0,c1=Secret-Secret:AB
|
||||||
|
s2-s15:c0.c1023=Secret-SystemHigh
|
||||||
|
s2:c0-s2:c0,c1=Secret:A-Secret:AB
|
||||||
|
s2:c0-s15:c0.c1023=Secret:A-SystemHigh
|
||||||
|
s2:c1-s2:c0,c1=Secret:B-Secret:AB
|
||||||
|
s2:c1-s15:c0.c1023=Secret:B-SystemHigh
|
||||||
|
s2:c0,c1-s15:c0.c1023=Secret:AB-SystemHigh
|
||||||
19
setrans-targeted.conf
Normal file
19
setrans-targeted.conf
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
#
|
||||||
|
# Multi-Category Security translation table for SELinux
|
||||||
|
#
|
||||||
|
# Uncomment the following to disable translation libary
|
||||||
|
# disable=1
|
||||||
|
#
|
||||||
|
# Objects can be categorized with 0-1023 categories defined by the admin.
|
||||||
|
# Objects can be in more than one category at a time.
|
||||||
|
# Categories are stored in the system as c0-c1023. Users can use this
|
||||||
|
# table to translate the categories into a more meaningful output.
|
||||||
|
# Examples:
|
||||||
|
# s0:c0=CompanyConfidential
|
||||||
|
# s0:c1=PatientRecord
|
||||||
|
# s0:c2=Unclassified
|
||||||
|
# s0:c3=TopSecret
|
||||||
|
# s0:c1,c3=CompanyConfidentialRedHat
|
||||||
|
s0=SystemLow
|
||||||
|
s0-s0:c0.c1023=SystemLow-SystemHigh
|
||||||
|
s0:c0.c1023=SystemHigh
|
||||||
38
users-minimum
Normal file
38
users-minimum
Normal file
@ -0,0 +1,38 @@
|
|||||||
|
##################################
|
||||||
|
#
|
||||||
|
# Core User configuration.
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# gen_user(username, prefix, role_set, mls_defaultlevel, mls_range, [mcs_catetories])
|
||||||
|
#
|
||||||
|
# Note: Identities without a prefix wil not be listed
|
||||||
|
# in the users_extra file used by genhomedircon.
|
||||||
|
|
||||||
|
#
|
||||||
|
# system_u is the user identity for system processes and objects.
|
||||||
|
# There should be no corresponding Unix user identity for system,
|
||||||
|
# and a user process should never be assigned the system user
|
||||||
|
# identity.
|
||||||
|
#
|
||||||
|
gen_user(system_u,, system_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
|
||||||
|
#
|
||||||
|
# user_u is a generic user identity for Linux users who have no
|
||||||
|
# SELinux user identity defined. The modified daemons will use
|
||||||
|
# this user identity in the security context if there is no matching
|
||||||
|
# SELinux user identity for a Linux user. If you do not want to
|
||||||
|
# permit any access to such users, then remove this entry.
|
||||||
|
#
|
||||||
|
gen_user(user_u, user, user_r, s0, s0)
|
||||||
|
gen_user(staff_u, user, staff_r system_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
|
||||||
|
#
|
||||||
|
# The following users correspond to Unix identities.
|
||||||
|
# These identities are typically assigned as the user attribute
|
||||||
|
# when login starts the user shell. Users with access to the sysadm_r
|
||||||
|
# role should use the staff_r role instead of the user_r role when
|
||||||
|
# not in the sysadm_r.
|
||||||
|
#
|
||||||
|
gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
38
users-mls
Normal file
38
users-mls
Normal file
@ -0,0 +1,38 @@
|
|||||||
|
##################################
|
||||||
|
#
|
||||||
|
# Core User configuration.
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# gen_user(username, prefix, role_set, mls_defaultlevel, mls_range, [mcs_catetories])
|
||||||
|
#
|
||||||
|
# Note: Identities without a prefix wil not be listed
|
||||||
|
# in the users_extra file used by genhomedircon.
|
||||||
|
|
||||||
|
#
|
||||||
|
# system_u is the user identity for system processes and objects.
|
||||||
|
# There should be no corresponding Unix user identity for system,
|
||||||
|
# and a user process should never be assigned the system user
|
||||||
|
# identity.
|
||||||
|
#
|
||||||
|
gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
|
||||||
|
#
|
||||||
|
# user_u is a generic user identity for Linux users who have no
|
||||||
|
# SELinux user identity defined. The modified daemons will use
|
||||||
|
# this user identity in the security context if there is no matching
|
||||||
|
# SELinux user identity for a Linux user. If you do not want to
|
||||||
|
# permit any access to such users, then remove this entry.
|
||||||
|
#
|
||||||
|
gen_user(user_u, user, user_r, s0, s0)
|
||||||
|
gen_user(staff_u, user, staff_r system_r sysadm_r secadm_r auditadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
|
||||||
|
#
|
||||||
|
# The following users correspond to Unix identities.
|
||||||
|
# These identities are typically assigned as the user attribute
|
||||||
|
# when login starts the user shell. Users with access to the sysadm_r
|
||||||
|
# role should use the staff_r role instead of the user_r role when
|
||||||
|
# not in the sysadm_r.
|
||||||
|
#
|
||||||
|
gen_user(root, user, sysadm_r staff_r secadm_r auditadm_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
38
users-targeted
Normal file
38
users-targeted
Normal file
@ -0,0 +1,38 @@
|
|||||||
|
##################################
|
||||||
|
#
|
||||||
|
# Core User configuration.
|
||||||
|
#
|
||||||
|
|
||||||
|
#
|
||||||
|
# gen_user(username, prefix, role_set, mls_defaultlevel, mls_range, [mcs_catetories])
|
||||||
|
#
|
||||||
|
# Note: Identities without a prefix wil not be listed
|
||||||
|
# in the users_extra file used by genhomedircon.
|
||||||
|
|
||||||
|
#
|
||||||
|
# system_u is the user identity for system processes and objects.
|
||||||
|
# There should be no corresponding Unix user identity for system,
|
||||||
|
# and a user process should never be assigned the system user
|
||||||
|
# identity.
|
||||||
|
#
|
||||||
|
gen_user(system_u,, system_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
|
||||||
|
#
|
||||||
|
# user_u is a generic user identity for Linux users who have no
|
||||||
|
# SELinux user identity defined. The modified daemons will use
|
||||||
|
# this user identity in the security context if there is no matching
|
||||||
|
# SELinux user identity for a Linux user. If you do not want to
|
||||||
|
# permit any access to such users, then remove this entry.
|
||||||
|
#
|
||||||
|
gen_user(user_u, user, user_r, s0, s0)
|
||||||
|
gen_user(staff_u, user, staff_r system_r sysadm_r unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
gen_user(sysadm_u, user, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
|
|
||||||
|
#
|
||||||
|
# The following users correspond to Unix identities.
|
||||||
|
# These identities are typically assigned as the user attribute
|
||||||
|
# when login starts the user shell. Users with access to the sysadm_r
|
||||||
|
# role should use the staff_r role instead of the user_r role when
|
||||||
|
# not in the sysadm_r.
|
||||||
|
#
|
||||||
|
gen_user(root, user, unconfined_r sysadm_r staff_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
Loading…
x
Reference in New Issue
Block a user