From db74d84097edd276ae3cecd22b8a5cd9efc8324e Mon Sep 17 00:00:00 2001 From: HuaxinLuGitee <1539327763@qq.com> Date: Sun, 13 Dec 2020 15:27:49 +0800 Subject: [PATCH] add avc --- add-avc-for-openEuler-1.patch | 63 +++++++++++++++++++++++++++++++++++ selinux-policy.spec | 6 +++- 2 files changed, 68 insertions(+), 1 deletion(-) create mode 100644 add-avc-for-openEuler-1.patch diff --git a/add-avc-for-openEuler-1.patch b/add-avc-for-openEuler-1.patch new file mode 100644 index 0000000..a7880ea --- /dev/null +++ b/add-avc-for-openEuler-1.patch @@ -0,0 +1,63 @@ +From 076002627934ea3f9ec59de1dde25a840bd1a452 Mon Sep 17 00:00:00 2001 +From: HuaxinLuGitee <1539327763@qq.com> +Date: Sun, 13 Dec 2020 14:48:26 +0800 +Subject: [PATCH] add-avc-for-openEuler-1 + +--- + policy/modules/contrib/firewalld.te | 2 ++ + policy/modules/contrib/logrotate.te | 4 +++- + policy/modules/system/init.te | 1 + + 3 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/policy/modules/contrib/firewalld.te b/policy/modules/contrib/firewalld.te +index d23045d..d8c5f25 100644 +--- a/policy/modules/contrib/firewalld.te ++++ b/policy/modules/contrib/firewalld.te +@@ -107,6 +107,8 @@ sysnet_relabelto_net_conf(firewalld_t) + userdom_dontaudit_create_admin_dir(firewalld_t) + userdom_dontaudit_manage_admin_dir(firewalld_t) + ++files_rw_var_lib_dirs(firewalld_t) ++ + optional_policy(` + dbus_system_domain(firewalld_t, firewalld_exec_t) + +diff --git a/policy/modules/contrib/logrotate.te b/policy/modules/contrib/logrotate.te +index 98019eb..559c079 100644 +--- a/policy/modules/contrib/logrotate.te ++++ b/policy/modules/contrib/logrotate.te +@@ -145,6 +145,7 @@ files_manage_generic_spool(logrotate_t) + files_manage_generic_spool_dirs(logrotate_t) + files_getattr_generic_locks(logrotate_t) + files_dontaudit_list_mnt(logrotate_t) ++files_list_var(logrotate_t) + + fs_search_auto_mountpoints(logrotate_t) + fs_getattr_xattr_fs(logrotate_t) +@@ -239,9 +240,10 @@ optional_policy(` + + optional_policy(` + apache_read_config(logrotate_t) +- apache_read_sys_content_rw_dirs(logrotate_t) ++ apache_read_sys_content_rw_dirs(logrotate_t) + apache_domtrans(logrotate_t) + apache_signull(logrotate_t) ++ apache_read_sys_content(logrotate_t) + ') + + optional_policy(` +diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te +index d8ca280..0bc90bf 100644 +--- a/policy/modules/system/init.te ++++ b/policy/modules/system/init.te +@@ -597,6 +597,7 @@ files_mounton_kernel_symbol_table(init_t) + files_manage_all_pid_dirs(init_t) + files_write_all_pid_sockets(init_t) + files_manage_etc_dirs(init_t) ++files_rw_etc_files(init_t) + files_manage_generic_tmp_dirs(init_t) + files_relabel_all_pid_dirs(init_t) + files_relabel_all_pid_files(init_t) +-- +1.8.3.1 + diff --git a/selinux-policy.spec b/selinux-policy.spec index e6d6fc9..d9e991f 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -12,7 +12,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.14.2 -Release: 63 +Release: 64 License: GPLv2+ URL: https://github.com/fedora-selinux/selinux-policy/ @@ -65,6 +65,7 @@ Patch12: add-avc-for-systemd.patch Patch13: allow-systemd-to-mount-unlabeled-filesystemd.patch Patch14: add_userman_access_run_dir.patch Patch15: add-allow-systemd-timedated-to-unlink-etc-link.patch +Patch16: add-avc-for-openEuler-1.patch BuildArch: noarch BuildRequires: python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc @@ -731,6 +732,9 @@ exit 0 %endif %changelog +* Sun Dec 13 2020 luhuaxin <1539327763@qq.com> - 3.14.2-64 +- add avc for openEuler + * Tue Dec 8 2020 openEuler Buildteam - 3.14.2-63 - add allow systemd timedated to unlink etc file -- Gitee