From 2dd946900827ae3390bec3571b9e288cfcbbb516 Mon Sep 17 00:00:00 2001 From: luhuaxin <1539327763@qq.com> Date: Mon, 7 Jun 2021 21:57:44 +0800 Subject: [PATCH] fix context of ebtables --- ...tables.fc-Add-missing-legacy-entries.patch | 39 +++++++++++++++ ...emove-duplicate-file-context-entries.patch | 49 +++++++++++++++++++ selinux-policy.spec | 7 ++- 3 files changed, 94 insertions(+), 1 deletion(-) create mode 100644 backport-iptables.fc-Add-missing-legacy-entries.patch create mode 100644 backport-iptables.fc-Remove-duplicate-file-context-entries.patch diff --git a/backport-iptables.fc-Add-missing-legacy-entries.patch b/backport-iptables.fc-Add-missing-legacy-entries.patch new file mode 100644 index 0000000..adfbb06 --- /dev/null +++ b/backport-iptables.fc-Add-missing-legacy-entries.patch @@ -0,0 +1,39 @@ +From feefaa074e75466aa75c29f17a3d83ac6ce004f0 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Thu, 18 Feb 2021 10:00:12 +0100 +Subject: [PATCH] iptables.fc: Add missing legacy entries + +The iptables, arptables, and ebtables stack is being deprecated in favor +of nftables. For now, netfilter reimplementations of these tools are +available for backwards compatibility, but have a diffferent filename +now (the main location is now a symlink). Add file context entries for +arptables and ebtables; iptables is already covered by the wildcard +rule. + +This change fixed several ebtables-related denials for me. + +Signed-off-by: Ondrej Mosnacek +--- + policy/modules/system/iptables.fc | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc +index 2c19023..9fb2e34 100644 +--- a/policy/modules/system/iptables.fc ++++ b/policy/modules/system/iptables.fc +@@ -13,10 +13,12 @@ + /usr/libexec/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0) + + /usr/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0) ++/usr/sbin/arptables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0) ++/usr/sbin/ebtables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +-- +1.8.3.1 + diff --git a/backport-iptables.fc-Remove-duplicate-file-context-entries.patch b/backport-iptables.fc-Remove-duplicate-file-context-entries.patch new file mode 100644 index 0000000..a6d0c40 --- /dev/null +++ b/backport-iptables.fc-Remove-duplicate-file-context-entries.patch @@ -0,0 +1,49 @@ +From c33aa1f2bdb74f689bd54565e363fa67f3aa148f Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Thu, 18 Feb 2021 09:50:50 +0100 +Subject: [PATCH] iptables.fc: Remove duplicate file context entries + +There is an quivalency rule /sbin -> /usr/sbin so these are redundant. +A few entries were missing in the /usr/sbin block - add them to avoid +regressions. + +Signed-off-by: Ondrej Mosnacek +--- + policy/modules/system/iptables.fc | 20 ++------------------ + 1 file changed, 2 insertions(+), 18 deletions(-) + +diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc +index d8161fc..639a59b 100644 +--- a/policy/modules/system/iptables.fc ++++ b/policy/modules/system/iptables.fc +@@ -12,25 +12,9 @@ + + /usr/libexec/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0) + +-/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ip6?tables-restore.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ip6?tables-multi.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ipvsadm -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/nft -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/xtables-legacy-multi -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/xtables-nft-multi -- gen_context(system_u:object_r:iptables_exec_t,s0) +- + /usr/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0) ++/usr/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) ++/usr/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) +-- +1.8.3.1 + diff --git a/selinux-policy.spec b/selinux-policy.spec index 96005f4..280c6c0 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -12,7 +12,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.14.2 -Release: 73 +Release: 74 License: GPLv2+ URL: https://github.com/fedora-selinux/selinux-policy/ @@ -107,6 +107,8 @@ Patch6032: backport-Allow-dhcpc_t-domain-transition-to-chronyc_t.patch Patch6033: backport-Allow-nsswitch_domain-read-cgroup-files.patch Patch6034: backport-Allow-IPsec-and-certmonger-to-use-opencryptoki-servi.patch Patch6035: backport-Create-chronyd_pid_filetrans-interface.patch +Patch6036: backport-iptables.fc-Remove-duplicate-file-context-entries.patch +Patch6037: backport-iptables.fc-Add-missing-legacy-entries.patch BuildArch: noarch BuildRequires: python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc @@ -772,6 +774,9 @@ exit 0 %endif %changelog +* Mon Jun 7 2021 luhuaxin <1539327763@qq.com> - 3.14.2-74 +- fix context of ebtables + * Thu Jun 3 2021 luhuaxin <1539327763@qq.com> - 3.14.2-73 - dont remove .autorelabel after install -- Gitee