From b8a0fc65cf2a874d966033a9213b58ebd6382e2b Mon Sep 17 00:00:00 2001 From: luhuaxin <1539327763@qq.com> Date: Thu, 17 Jun 2021 21:45:06 +0800 Subject: [PATCH] [backport] iptables.fc: Add missing legacy-restore and legacy-save entries --- ...missing-legacy-restore-and-legacy-sa.patch | 40 +++++++++++++++++++ selinux-policy.spec | 6 ++- 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 backport-iptables.fc-Add-missing-legacy-restore-and-legacy-sa.patch diff --git a/backport-iptables.fc-Add-missing-legacy-restore-and-legacy-sa.patch b/backport-iptables.fc-Add-missing-legacy-restore-and-legacy-sa.patch new file mode 100644 index 0000000..97e1784 --- /dev/null +++ b/backport-iptables.fc-Add-missing-legacy-restore-and-legacy-sa.patch @@ -0,0 +1,40 @@ +From dfbaf8f3be6470e0964df8c1b5ae9717f85a4675 Mon Sep 17 00:00:00 2001 +From: LuLuLu <1539327763@qq.com> +Date: Fri, 11 Jun 2021 11:25:18 +0800 +Subject: [PATCH] iptables.fc: Add missing legacy-restore and legacy-save + entries + +/usr/sbin/ebtables-restore and /usr/sbin/ebtables-save are miss labeled now. Each of them is a link file that can link to two differenet files. + +For /usr/sbin/ebtables-restore on fc 34: + +Remove iptables-nft and install ebtables-legacy: +lrwxrwxrwx. 1 root root 34 Apr 23 06:56 /sbin/ebtables-restore -> /etc/alternatives/ebtables-restore +lrwxrwxrwx. 1 root root 33 Jun 10 20:31 /etc/alternatives/ebtables-restore -> /usr/sbin/ebtables-legacy-restore + +Remove ebtables-legacy and install iptables-nft: +lrwxrwxrwx. 1 root root 34 Apr 23 06:56 /sbin/ebtables-restore -> /etc/alternatives/ebtables-restore +lrwxrwxrwx. 1 root root 30 Jun 10 20:35 /etc/alternatives/ebtables-restore -> /usr/sbin/ebtables-nft-restore +lrwxrwxrwx. 1 root root 17 Jan 28 08:48 /usr/sbin/ebtables-nft-restore -> xtables-nft-multi + +/sbin/ebtables-save is similar. But the label of /usr/sbin/ebtables-legacy-restore and /usr/sbin/ebtables-legacy-save is lack. +--- + policy/modules/system/iptables.fc | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc +index 9fb2e34..e8ee5c0 100644 +--- a/policy/modules/system/iptables.fc ++++ b/policy/modules/system/iptables.fc +@@ -19,6 +19,8 @@ + /usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ebtables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0) ++/usr/sbin/ebtables-legacy-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) ++/usr/sbin/ebtables-legacy-save -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0) + /usr/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +-- +1.8.3.1 + diff --git a/selinux-policy.spec b/selinux-policy.spec index 7e2e639..8d6f311 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -12,7 +12,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.14.2 -Release: 73 +Release: 74 License: GPLv2+ URL: https://github.com/fedora-selinux/selinux-policy/ @@ -109,6 +109,7 @@ Patch6034: backport-Allow-IPsec-and-certmonger-to-use-opencryptoki-servi.patch Patch6035: backport-Create-chronyd_pid_filetrans-interface.patch Patch6036: backport-iptables.fc-Remove-duplicate-file-context-entries.patch Patch6037: backport-iptables.fc-Add-missing-legacy-entries.patch +Patch6038: backport-iptables.fc-Add-missing-legacy-restore-and-legacy-sa.patch BuildArch: noarch BuildRequires: python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc @@ -774,6 +775,9 @@ exit 0 %endif %changelog +* Thu Jun 17 2021 luhuaxin <1539327763@qq.com> - 3.14.2-74 +- iptables.fc: Add missing legacy-restore and legacy-save entries + * Mon Jun 7 2021 luhuaxin <1539327763@qq.com> - 3.14.2-73 - fix context of ebtables -- Gitee