From ac40cc96e9df44526e6467708d35efa3eacaf6d6 Mon Sep 17 00:00:00 2001 From: HuaxinLuGitee <1539327763@qq.com> Date: Fri, 5 Mar 2021 10:45:32 +0800 Subject: [PATCH] sync modification and backport 1 upstream patch --- ...ort-Allow-dovecot-bind-to-smtp-ports.patch | 29 +++++++++++++++ ...linux_get_enforce_mode-to-allow-stat.patch | 37 +++++++++++++++++++ selinux-policy.spec | 8 +++- 3 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 backport-Allow-dovecot-bind-to-smtp-ports.patch create mode 100644 backport-selinux-tweak-selinux_get_enforce_mode-to-allow-stat.patch diff --git a/backport-Allow-dovecot-bind-to-smtp-ports.patch b/backport-Allow-dovecot-bind-to-smtp-ports.patch new file mode 100644 index 0000000..6ba6751 --- /dev/null +++ b/backport-Allow-dovecot-bind-to-smtp-ports.patch @@ -0,0 +1,29 @@ +From f5c688321e04364bdfd030dd1412a7e5a4ecc6b6 Mon Sep 17 00:00:00 2001 +From: Zdenek Pytela +Date: Tue, 10 Nov 2020 18:04:49 +0100 +Subject: [PATCH] Allow dovecot bind to smtp ports + +When dovecot is configured to listen on submission ports +(tcp 465 or 587), it requires the name_bind permission to ports +labeled smtp_port_t. + +Resolves: rhbz#1881884 +--- + dovecot.te | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/policy/modules/contrib/dovecot.te b/policy/modules/contrib/dovecot.te +index 6cf4b72e9..0b140e932 100644 +--- a/policy/modules/contrib/dovecot.te ++++ b/policy/modules/contrib/dovecot.te +@@ -147,6 +147,7 @@ corenet_tcp_bind_mail_port(dovecot_t) + corenet_tcp_bind_pop_port(dovecot_t) + corenet_tcp_bind_lmtp_port(dovecot_t) + corenet_tcp_bind_sieve_port(dovecot_t) ++corenet_tcp_bind_smtp_port(dovecot_t) + corenet_tcp_connect_all_ports(dovecot_t) + corenet_tcp_connect_postgresql_port(dovecot_t) + corenet_sendrecv_pop_server_packets(dovecot_t) +-- +2.23.0 + diff --git a/backport-selinux-tweak-selinux_get_enforce_mode-to-allow-stat.patch b/backport-selinux-tweak-selinux_get_enforce_mode-to-allow-stat.patch new file mode 100644 index 0000000..8783ef1 --- /dev/null +++ b/backport-selinux-tweak-selinux_get_enforce_mode-to-allow-stat.patch @@ -0,0 +1,37 @@ +From f88337df43f6afce019ad8431815dde794a4f4d9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= +Date: Wed, 28 Oct 2020 09:26:42 +0100 +Subject: [PATCH] selinux: tweak selinux_get_enforce_mode() to allow status + page to be used + +https://github.com/SELinuxProject/refpolicy/pull/308/commits/24827d807379302f5e6d31389911292d304136a1 +creates a separate interface for this, but I don't think it makes sense +to complicate things so much. The intent of selinux_get_enforce_mode() +is allow status to be checked. Over time various code that checks it +will transistion to the new more efficient interface. In the meantime, allow +both. At some point in the future, selinux_get_enforce_mode() can be +reduced to + dev_search_sysfs($1) + allow $1 security_t:dir list_dir_perms; + allow $1 security_t:file mmap_read_file_perms; +like selinux_use_status_page() in refpolicy. +--- + policy/modules/kernel/selinux.if | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/policy/modules/kernel/selinux.if b/policy/modules/kernel/selinux.if +index ac70efb08..a2ab3fca5 100644 +--- a/policy/modules/kernel/selinux.if ++++ b/policy/modules/kernel/selinux.if +@@ -324,7 +324,7 @@ interface(`selinux_get_enforce_mode',` + dev_search_sysfs($1) + selinux_get_fs_mount($1) + allow $1 security_t:dir list_dir_perms; +- allow $1 security_t:file read_file_perms; ++ allow $1 security_t:file mmap_read_file_perms; + allow $1 security_t:lnk_file read_lnk_file_perms; + ') + +-- +2.23.0 + diff --git a/selinux-policy.spec b/selinux-policy.spec index d3e7fdb..346480a 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -12,7 +12,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.14.2 -Release: 66 +Release: 67 License: GPLv2+ URL: https://github.com/fedora-selinux/selinux-policy/ @@ -71,6 +71,8 @@ Patch18: add-firewalld-fc.patch Patch19: add-allow-systemd-timedated-to-unlink-etc-link.patch Patch20: add-avc-for-openEuler-1.patch Patch21: backport-systemd-allow-all-systemd-services-to-check-selinux-.patch +Patch22: backport-Allow-dovecot-bind-to-smtp-ports.patch +Patch23: backport-selinux-tweak-selinux_get_enforce_mode-to-allow-stat.patch BuildArch: noarch BuildRequires: python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc @@ -736,6 +738,10 @@ exit 0 %endif %changelog +Sat Feb 27 2021 luhuaxin <1539327763@qq.com> - 3.14.2-67 +- add avc for allowing dovecot bind to smtp ports +- add mmap permission in selinux_get_enforce_mode interface + Sat Feb 27 2021 luhuaxin <1539327763@qq.com> - 3.14.2-66 - add allow systemd services to check selinux status -- Gitee