From f501d867167e8fed408e87ef4289b5a582b4d6d8 Mon Sep 17 00:00:00 2001 From: HuaxinLuGitee <1539327763@qq.com> Date: Fri, 5 Mar 2021 10:11:01 +0800 Subject: [PATCH 1/2] sync modification on other branches --- ...ort-Allow-dovecot-bind-to-smtp-ports.patch | 29 +++++++++++++ ...l-systemd-services-to-check-selinux-.patch | 42 +++++++++++++++++++ rpm.macros | 4 -- 3 files changed, 71 insertions(+), 4 deletions(-) create mode 100644 backport-Allow-dovecot-bind-to-smtp-ports.patch create mode 100644 backport-systemd-allow-all-systemd-services-to-check-selinux-.patch diff --git a/backport-Allow-dovecot-bind-to-smtp-ports.patch b/backport-Allow-dovecot-bind-to-smtp-ports.patch new file mode 100644 index 0000000..6ba6751 --- /dev/null +++ b/backport-Allow-dovecot-bind-to-smtp-ports.patch @@ -0,0 +1,29 @@ +From f5c688321e04364bdfd030dd1412a7e5a4ecc6b6 Mon Sep 17 00:00:00 2001 +From: Zdenek Pytela +Date: Tue, 10 Nov 2020 18:04:49 +0100 +Subject: [PATCH] Allow dovecot bind to smtp ports + +When dovecot is configured to listen on submission ports +(tcp 465 or 587), it requires the name_bind permission to ports +labeled smtp_port_t. + +Resolves: rhbz#1881884 +--- + dovecot.te | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/policy/modules/contrib/dovecot.te b/policy/modules/contrib/dovecot.te +index 6cf4b72e9..0b140e932 100644 +--- a/policy/modules/contrib/dovecot.te ++++ b/policy/modules/contrib/dovecot.te +@@ -147,6 +147,7 @@ corenet_tcp_bind_mail_port(dovecot_t) + corenet_tcp_bind_pop_port(dovecot_t) + corenet_tcp_bind_lmtp_port(dovecot_t) + corenet_tcp_bind_sieve_port(dovecot_t) ++corenet_tcp_bind_smtp_port(dovecot_t) + corenet_tcp_connect_all_ports(dovecot_t) + corenet_tcp_connect_postgresql_port(dovecot_t) + corenet_sendrecv_pop_server_packets(dovecot_t) +-- +2.23.0 + diff --git a/backport-systemd-allow-all-systemd-services-to-check-selinux-.patch b/backport-systemd-allow-all-systemd-services-to-check-selinux-.patch new file mode 100644 index 0000000..424b3a3 --- /dev/null +++ b/backport-systemd-allow-all-systemd-services-to-check-selinux-.patch @@ -0,0 +1,42 @@ +From a96ac9ed374cab65f53a26cd39053705569532bc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Wed, 28 Oct 2020 09:17:15 +0100 +Subject: [PATCH] systemd: allow all systemd services to check selinux status + +After https://github.com/systemd/systemd/commit/fd5e402fa9 most systemd +services fail to start with: + +Oct 27 13:50:38 workstation-uefi systemd[1]: Starting systemd-hostnamed.service... +Oct 27 13:50:38 workstation-uefi systemd-hostnamed[944]: Failed to open SELinux status page: Permission denied +Oct 27 13:50:38 workstation-uefi systemd[1]: systemd-hostnamed.service: Main process exited, code=exited, status=1/FAILURE + +After disabling dontaudit: + +Oct 27 14:05:08 workstation-uefi audit[1043]: AVC avc: denied { read } for pid=1043 comm="systemd-hostnam" name="status" dev="selinuxfs" ino=19 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=file permissive=1 +Oct 27 14:05:08 workstation-uefi audit[1043]: AVC avc: denied { open } for pid=1043 comm="systemd-hostnam" path="/sys/fs/selinux/status" dev="selinuxfs" ino=19 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=file permissive=1 +Oct 27 14:05:08 workstation-uefi audit[1043]: AVC avc: denied { map } for pid=1043 comm="systemd-hostnam" path="/sys/fs/selinux/status" dev="selinuxfs" ino=19 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=file permissive=1 + +As first step, allow all systemd services to check selinux status. +The check for selinux status is called from mac_selinux_init() which +is called in 16 different places, so I don't think it makes sense to +try to list them all. Any code which wants to create a labelled file is +likely to call mac_selinux_init(). +--- + policy/modules/system/systemd.if | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if +index ff3116142..253396f1c 100644 +--- a/policy/modules/system/systemd.if ++++ b/policy/modules/system/systemd.if +@@ -24,6 +24,7 @@ template(`systemd_domain_template',` + kernel_read_system_state($1_t) + + auth_use_nsswitch($1_t) ++ selinux_get_enforce_mode($1_t) + ') + + ###################################### +-- +2.23.0 + diff --git a/rpm.macros b/rpm.macros index f63f5fe..9da4c61 100644 --- a/rpm.macros +++ b/rpm.macros @@ -38,11 +38,7 @@ BuildRequires: selinux-policy-devel \ Requires(post): selinux-policy-base >= %{_selinux_policy_version} \ Requires(post): libselinux-utils \ Requires(post): policycoreutils \ -%if 0%{?fedora} || 0%{?rhel} > 7\ Requires(post): policycoreutils-python-utils \ -%else \ -Requires(post): policycoreutils-python \ -%endif \ %{nil} # %selinux_modules_install [-s ] [-p ] module [module]... -- Gitee From ec8e4ca78ae440951e2968d7c1a28a9b64d85278 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=8D=A2=E5=8D=8E=E6=AD=86?= <1539327763@qq.com> Date: Fri, 5 Mar 2021 10:13:52 +0800 Subject: [PATCH 2/2] update spec file --- selinux-policy.spec | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/selinux-policy.spec b/selinux-policy.spec index e9daef6..336fe77 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -12,7 +12,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.14.2 -Release: 65 +Release: 66 License: GPLv2+ URL: https://github.com/fedora-selinux/selinux-policy/ @@ -67,6 +67,8 @@ Patch14: add_userman_access_run_dir.patch Patch15: add-allow-systemd-timedated-to-unlink-etc-link.patch Patch16: add-avc-for-openEuler-1.patch Patch17: add-firewalld-fc.patch +Patch18: backport-systemd-allow-all-systemd-services-to-check-selinux-.patch +Patch19: backport-Allow-dovecot-bind-to-smtp-ports.patch BuildArch: noarch BuildRequires: python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc @@ -733,6 +735,11 @@ exit 0 %endif %changelog +* Fri Mar 5 2021 luhuaxin <1539327763@qq.com> - 3.14.2-66 +- selinux_requires macro shouldn't depend on policycoreutils-python +- add avc for allowing systemd services to check selinux status +- add avc for allowing dovecot to bind smtp port + * Tue Dec 23 2020 openEuler Buildteam - 3.14.2-65 - add add-firewalld-fc.patch -- Gitee