回合上游社区补丁,补丁数量：10

<table ><tr><td colSpan="1" rowSpan="1">软件包</td><td colSpan="1" rowSpan="1">CommitId</td><td colSpan="2" rowSpan="1">描述</td></tr><tr><td colSpan="1" rowSpan="1">openEuler:selinux-policy</td><td colSpan="1" rowSpan="1">6bb335549d5b46078a8e62ad1b3d89b37af185fe</td><td colSpan="2" rowSpan="1">Allow nvme_stas_t create and use netlink kobject uevent socket Some permissions were allowed, but not all for stafd be able to use the netlink class socket from the kobject uevent family. The commit addresses the following AVC denial: type=PROCTITLE msg=audit(12/14/2023 03:16:43.776:934) : proctitle=/usr/bin/python3 /usr/sbin/stafd --syslog type=SYSCALL msg=audit(12/14/2023 03:16:43.776:934) : arch=x86_64 syscall=getsockopt success=no exit=EACCES(Permission denied) a0=0x3 a1=SOL_SOCKET a2=SO_RCVBUF a3=0x7ffcc7b7384c items=0 ppid=1 pid=14412 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=stafd exe=/usr/bin/python3.12 subj=system_u:system_r:nvme_stas_t:s0 key=(null) type=AVC msg=audit(12/14/2023 03:16:43.776:934) : avc: denied { getopt } for pid=14412 comm=stafd scontext=system_u:system_r:nvme_stas_t:s0 tcontext=system_u:system_r:nvme_stas_t:s0 tclass=netlink_kobject_uevent_socket permissive=0</td></tr><tr><td colSpan="1" rowSpan="1">openEuler:selinux-policy</td><td colSpan="1" rowSpan="1">736057fd513a64a21c3b75108da8d640c901eae8</td><td colSpan="2" rowSpan="1">Label /etc/redis.conf with redis_conf_t</td></tr><tr><td colSpan="1" rowSpan="1">openEuler:selinux-policy</td><td colSpan="1" rowSpan="1">db3a9e8c950194c27867791e88f605cc7448b104</td><td colSpan="2" rowSpan="1">Allow dovecot_auth_t connect to postgresql using UNIX socket Addreses following AVCs: type=AVC msg=audit(1700326791.924:28417): avc: denied { write } for pid=379029 comm=auth name=.s.PGSQL.5432 dev=tmpfs ino=21504 scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:object_r:postgresql_var_run_t:s0 tclass=sock_file permissive=0 type=SYSCALL msg=audit(1700326791.924:28417): arch=c000003e syscall=42 success=no exit=-13 a0=14 a1=5635d4b2bc20 a2=6e a3=7f06cf6a4c48 items=0 ppid=378824 pid=379029 auid=4294967295 uid=97 gid=97 euid=97 suid=97 fsuid=97 egid=97 sgid=97 fsgid=97 tty=(none) ses=4294967295 comm=auth exe=/usr/libexec/dovecot/auth subj=system_u:system_r:dovecot_auth_t:s0 key=(null)ARCH=x86_64 SYSCALL=connect AUID=unset UID=dovecot GID=dovecot EUID=dovecot SUID=dovecot FSUID=dovecot EGID=dovecot SGID=dovecot FSGID=dovecot type=PROCTITLE msg=audit(1700326791.924:28417): proctitle=dovecot/auth type=AVC msg=audit(1700326791.960:28418): avc: denied { write } for pid=379030 comm=auth name=.s.PGSQL.5432 dev=tmpfs ino=21504 scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:object_r:postgresql_var_run_t:s0 tclass=sock_file permissive=0 type=SYSCALL msg=audit(1700326791.960:28418): arch=c000003e syscall=42 success=no exit=-13 a0=d a1=56244e950630 a2=6e a3=7fe995ddbc48 items=0 ppid=378824 pid=379030 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=auth exe=/usr/libexec/dovecot/auth subj=system_u:system_r:dovecot_auth_t:s0 key=(null)ARCH=x86_64 SYSCALL=connect AUID=unset UID=root GID=root EUID=root SUID=root FSUID=root EGID=root SGID=root FSGID=root type=PROCTITLE msg=audit(1700326791.960:28418): proctitle=646F7665636F742F61757468002D77 type=AVC msg=audit(1700326791.967:28419): avc: denied { write } for pid=379029 comm=auth name=.s.PGSQL.5432 dev=tmpfs ino=21504 scontext=system_u:system_r:dovecot_auth_t:s0 tcontext=system_u:object_r:postgresql_var_run_t:s0 tclass=sock_file permissive=0 type=SYSCALL msg=audit(1700326791.967:28419): arch=c000003e syscall=42 success=no exit=-13 a0=16 a1=5635d4b38ae0 a2=6e a3=7f06cf6a4c48 items=0 ppid=378824 pid=379029 auid=4294967295 uid=97 gid=97 euid=97 suid=97 fsuid=97 egid=97 sgid=97 fsgid=97 tty=(none) ses=4294967295 comm=auth exe=/usr/libexec/dovecot/auth subj=system_u:system_r:dovecot_auth_t:s0 key=(null)ARCH=x86_64 SYSCALL=connect AUID=unset UID=dovecot GID=dovecot EUID=dovecot SUID=dovecot FSUID=dovecot EGID=dovecot SGID=dovecot FSGID=dovecot type=PROCTITLE msg=audit(1700326791.967:28419): proctitle=dovecot/auth Resolves: RHEL-16850</td></tr><tr><td colSpan="1" rowSpan="1">openEuler:selinux-policy</td><td colSpan="1" rowSpan="1">8c600db3483b0deaaba2ccc18cba74f2dfa5d680</td><td colSpan="2" rowSpan="1">Allow systemd-sleep send a message to syslog over a unix dgram socket The commit addresses the following AVC denial: type=AVC msg=audit(1702592947.333:248): avc: denied { sendto } for pid=7245 comm=systemd-sleep path=/run/systemd/journal/socket scontext=system_u:system_r:systemd_sleep_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=unix_dgram_socket permissive=0 Resolves: rhbz#2254628</td></tr><tr><td colSpan="1" rowSpan="1">openEuler:selinux-policy</td><td colSpan="1" rowSpan="1">591191b91f59e6f0cdd0283b4b11b3038fb8ca7e</td><td colSpan="2" rowSpan="1">Add additions to dnsmasq interface Allow reading the dnsmasq.d directory that stores additional config files. Add a new manage_config interface for dnsmasq config files and directory Misc comment clean up of dnsmasq.if Signed-off-by: georou </td></tr><tr><td colSpan="1" rowSpan="1">openEuler:selinux-policy</td><td colSpan="1" rowSpan="1">dd4669154ab176600d933f508b429cf116b23497</td><td colSpan="2" rowSpan="1">Allow keepalived_t to use sys_ptrace of cap_userns Addresses the following AVC: type=PROCTITLE msg=audit(12/08/2023 12:28:47.900:784) : proctitle=netstat -apn type=PATH msg=audit(12/08/2023 12:28:47.900:784) : item=0 name=/proc/834/fd/0 inode=183233 dev=00:14 mode=link,500 ouid=root ogid=root rdev=00:00 obj=system_u:system_r:devicekit_power_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(12/08/2023 12:28:47.900:784) : cwd=/ type=SYSCALL msg=audit(12/08/2023 12:28:47.900:784) : arch=x86_64 syscall=readlink success=yes exit=9 a0=0x7ffd2369a070 a1=0x7ffd23699e50 a2=0x1d a3=0xe items=1 ppid=66687 pid=66689 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=netstat exe=/usr/bin/netstat subj=system_u:system_r:keepalived_t:s0 key=(null) type=AVC msg=audit(12/08/2023 12:28:47.900:784) : avc: denied { sys_ptrace } for pid=66689 comm=netstat capability=sys_ptrace scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:system_r:keepalived_t:s0 tclass=cap_userns permissive=1 Resolves: RHEL-17156</td></tr><tr><td colSpan="1" rowSpan="1">openEuler:selinux-policy</td><td colSpan="1" rowSpan="1">03323582c0f9c0e843247d96969ef4d2e01453b0</td><td colSpan="2" rowSpan="1">Allow init create and use netlink netfilter socket systemd v255 [1] includes the core: firewall integration of cgroups with NFTSet= [2] commit which makes systemd directly use the netlink netfilter socket to work with firewall rules. [1] https://github.com/systemd/systemd/releases [2] https://github.com/systemd/systemd/commit/dc7d69b3c1eb The commit addresses the following AVC denial: type=AVC msg=audit(12/08/2023 06:07:03.373:259) : avc: denied { create } for pid=1 comm=systemd scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_netfilter_socket permissive=1 Resolves: rhbz#2250935</td></tr><tr><td colSpan="1" rowSpan="1">openEuler:selinux-policy</td><td colSpan="1" rowSpan="1">5187234e444d5ae9d957678bf257ea21529b2818</td><td colSpan="2" rowSpan="1">Allow qatlib read/write vfio devices The commit addresses the following AVC denial: type=PROCTITLE msg=audit(12.12.2023 09:16:26.851:299) : proctitle=/usr/sbin/qatmgr --policy=0 type=SYSCALL msg=audit(12.12.2023 09:16:26.851:299) : arch=x86_64 syscall=ioctl success=yes exit=0 a0=0x5 a1=0x3b69 a2=0x3 a3=0x70000000004 items=0 ppid=1 pid=63688 auid=unset uid=root gid=qat euid=root suid=root fsuid=root egid=qat sgid=qat fsgid=qat tty=(none) ses=unset comm=qatmgr exe=/usr/sbin/qatmgr subj=system_u:system_r:qatlib_t:s0 key=(null) type=AVC msg=audit(12.12.2023 09:16:26.851:299) : avc: denied { ioctl } for pid=63688 comm=qatmgr path=/dev/vfio/465 dev=devtmpfs ino=2030 ioctlcmd=0x3b69 scontext=system_u:system_r:qatlib_t:s0 tcontext=system_u:object_r:vfio_device_t:s0 tclass=chr_file permissive=1 Resolves: RHEL-19051</td></tr><tr><td colSpan="1" rowSpan="1">openEuler:selinux-policy</td><td colSpan="1" rowSpan="1">48593ca48ec2df52a28d65cc3d87d95f393578fc</td><td colSpan="2" rowSpan="1">Allow hypervkvp_t write access to NetworkManager_etc_rw_t Addresses following AVCs: type=AVC msg=audit(11/06/23 01:25:41.614:77) : avc: denied { search } for pid=1724 comm=cp name=system-connections dev=sda4 ino=17122767 scontext=system_u:system_r:hypervkvp_t:s0 tcontext=system_u:object_r:NetworkManager_etc_rw_t:s0 tclass=dir permissive=1 type=AVC msg=audit(11/06/23 01:25:41.614:77) : avc: denied { search } for pid=1724 comm=cp name=NetworkManager dev=sda4 ino=17122764 scontext=system_u:system_r:hypervkvp_t:s0 tcontext=system_u:object_r:NetworkManager_etc_t:s0 tclass=dir permissive=1 type=AVC msg=audit(11/06/23 01:25:41.615:78) : avc: denied { write open } for pid=1724 comm=cp path=/etc/NetworkManager/system-connections/eth0.nmconnection dev=sda4 ino=17123100 scontext=system_u:system_r:hypervkvp_t:s0 tcontext=system_u:object_r:NetworkManager_etc_rw_t:s0 tclass=file permissive=1 type=AVC msg=audit(11/06/23 01:25:41.615:78) : avc: denied { create } for pid=1724 comm=cp name=eth0.nmconnection scontext=system_u:system_r:hypervkvp_t:s0 tcontext=system_u:object_r:NetworkManager_etc_rw_t:s0 tclass=file permissive=1 type=AVC msg=audit(11/06/23 01:25:41.615:78) : avc: denied { add_name } for pid=1724 comm=cp name=eth0.nmconnection scontext=system_u:system_r:hypervkvp_t:s0 tcontext=system_u:object_r:NetworkManager_etc_rw_t:s0 tclass=dir permissive=1 type=AVC msg=audit(11/06/23 01:25:41.615:78) : avc: denied { write } for pid=1724 comm=cp name=system-connections dev=sda4 ino=17122767 scontext=system_u:system_r:hypervkvp_t:s0 tcontext=system_u:object_r:NetworkManager_etc_rw_t:s0 tclass=dir permissive=1 type=AVC msg=audit(11/06/23 01:25:41.615:79) : avc: denied { ioctl } for pid=1724 comm=cp path=/etc/NetworkManager/system-connections/eth0.nmconnection dev=sda4 ino=17123100 ioctlcmd=0x9409 scontext=system_u:system_r:hypervkvp_t:s0 tcontext=system_u:object_r:NetworkManager_etc_rw_t:s0 tclass=file permissive=1 Resolves: RHEL-14505</td></tr><tr><td colSpan="1" rowSpan="1">openEuler:selinux-policy</td><td colSpan="1" rowSpan="1">52cbc15d014b7cbc457bf3c926a738b1e1d83053</td><td colSpan="2" rowSpan="1">Allow init read all non-security socket files Systemd uses the LoadCredential option to pass a credential to the unit. Credentials here are small objects that may be passed to unit processes, typically cryptographic keys or certificates, user account information or identity information from host to services. The credential files/IPC sockets must be accessible to the service manager, but don&#x27;t have to be directly accessible to the unit&#x27;s processes: the credential data is read and copied into separate, read-only copies for the unit that are accessible to appropriately privileged processes. Consequently, when LoadCredential is set to point to a socket file, systemd needs the read permission for the sock_file security class: LoadCredential=id:/run/wg-credentials.socket Systemd in its read_full_file_full() function checks exit code of xfopenat() and in case of -ENXIO connects to the AF_UNIX socket. The files_read_non_security_sock_files() interface was added. Addresses the following AVC denial: type=AVC msg=audit(1672210323.355:1362): avc: denied { read } for pid=4490 comm=(sd-mkdcreds) name=wg-credentials.socket dev=tmpfs ino=1033 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0</td></tr></table>
**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

src-openEuler/selinux-policy

Content Risk Flag

Comments (4)

src-openEuler/selinux-policy .gitee-modal { width: 500px !important; }

Content Risk Flag