diff --git a/backport-iptables.fc-Add-missing-legacy-entries.patch b/backport-iptables.fc-Add-missing-legacy-entries.patch new file mode 100644 index 0000000000000000000000000000000000000000..adfbb0694a6f4073933e0ece46d03a77dcbdd839 --- /dev/null +++ b/backport-iptables.fc-Add-missing-legacy-entries.patch @@ -0,0 +1,39 @@ +From feefaa074e75466aa75c29f17a3d83ac6ce004f0 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Thu, 18 Feb 2021 10:00:12 +0100 +Subject: [PATCH] iptables.fc: Add missing legacy entries + +The iptables, arptables, and ebtables stack is being deprecated in favor +of nftables. For now, netfilter reimplementations of these tools are +available for backwards compatibility, but have a diffferent filename +now (the main location is now a symlink). Add file context entries for +arptables and ebtables; iptables is already covered by the wildcard +rule. + +This change fixed several ebtables-related denials for me. + +Signed-off-by: Ondrej Mosnacek +--- + policy/modules/system/iptables.fc | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc +index 2c19023..9fb2e34 100644 +--- a/policy/modules/system/iptables.fc ++++ b/policy/modules/system/iptables.fc +@@ -13,10 +13,12 @@ + /usr/libexec/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0) + + /usr/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0) ++/usr/sbin/arptables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0) ++/usr/sbin/ebtables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +-- +1.8.3.1 + diff --git a/backport-iptables.fc-Remove-duplicate-file-context-entries.patch b/backport-iptables.fc-Remove-duplicate-file-context-entries.patch new file mode 100644 index 0000000000000000000000000000000000000000..a6d0c402c4cf86c8ba1bba54d4d728a8059c11d7 --- /dev/null +++ b/backport-iptables.fc-Remove-duplicate-file-context-entries.patch @@ -0,0 +1,49 @@ +From c33aa1f2bdb74f689bd54565e363fa67f3aa148f Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Thu, 18 Feb 2021 09:50:50 +0100 +Subject: [PATCH] iptables.fc: Remove duplicate file context entries + +There is an quivalency rule /sbin -> /usr/sbin so these are redundant. +A few entries were missing in the /usr/sbin block - add them to avoid +regressions. + +Signed-off-by: Ondrej Mosnacek +--- + policy/modules/system/iptables.fc | 20 ++------------------ + 1 file changed, 2 insertions(+), 18 deletions(-) + +diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc +index d8161fc..639a59b 100644 +--- a/policy/modules/system/iptables.fc ++++ b/policy/modules/system/iptables.fc +@@ -12,25 +12,9 @@ + + /usr/libexec/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0) + +-/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ip6?tables-restore.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ip6?tables-multi.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ipvsadm -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/nft -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/xtables-legacy-multi -- gen_context(system_u:object_r:iptables_exec_t,s0) +-/sbin/xtables-nft-multi -- gen_context(system_u:object_r:iptables_exec_t,s0) +- + /usr/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0) ++/usr/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) ++/usr/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) +-- +1.8.3.1 + diff --git a/selinux-policy.spec b/selinux-policy.spec index 9bee46160717f17232efacbc4db62a2c6addde59..7e2e6391579e34dd86de75e258cb7ad6480c1642 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -12,7 +12,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.14.2 -Release: 72 +Release: 73 License: GPLv2+ URL: https://github.com/fedora-selinux/selinux-policy/ @@ -107,6 +107,8 @@ Patch6032: backport-Allow-dhcpc_t-domain-transition-to-chronyc_t.patch Patch6033: backport-Allow-nsswitch_domain-read-cgroup-files.patch Patch6034: backport-Allow-IPsec-and-certmonger-to-use-opencryptoki-servi.patch Patch6035: backport-Create-chronyd_pid_filetrans-interface.patch +Patch6036: backport-iptables.fc-Remove-duplicate-file-context-entries.patch +Patch6037: backport-iptables.fc-Add-missing-legacy-entries.patch BuildArch: noarch BuildRequires: python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc @@ -772,6 +774,9 @@ exit 0 %endif %changelog +* Mon Jun 7 2021 luhuaxin <1539327763@qq.com> - 3.14.2-73 +- fix context of ebtables + * Thu Jun 3 2021 luhuaxin <1539327763@qq.com> - 3.14.2-72 - dont remove .autorelabel after install