From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 170BA138C8E for ; Mon, 24 Oct 2016 15:45:55 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 84027E0913; Mon, 24 Oct 2016 15:45:54 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 6F032E0913 for ; Mon, 24 Oct 2016 15:45:54 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 9E7AF341660 for ; Mon, 24 Oct 2016 15:45:53 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 12AA724A4 for ; Mon, 24 Oct 2016 15:45:52 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1475474661.c7941d5608f8aadd8be1cdda6abff4084b2e094e.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:swift commit in: policy/modules/system/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/system/selinuxutil.if policy/modules/system/selinuxutil.te X-VCS-Directories: policy/modules/system/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: c7941d5608f8aadd8be1cdda6abff4084b2e094e X-VCS-Branch: swift Date: Mon, 24 Oct 2016 15:45:52 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 8e78be9b-48b2-4e03-9e00-0c3139f121fa X-Archives-Hash: 169de6b91ab96fde404288f9e7e5ad18 commit: c7941d5608f8aadd8be1cdda6abff4084b2e094e Author: Jason Zaman via refpolicy oss tresys com> AuthorDate: Sun Sep 18 06:38:31 2016 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Mon Oct 3 06:04:21 2016 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=c7941d56 selinuxutil: allow setfiles to read semanage store commit a7334eb0de98af11ec38b6263536fa01bc2a606c libsemanage: validate and compile file contexts before installing validates the fcontexts when they are still in /var/lib/selinux. Without setfiles_t having access to read the files, validation fails and the policy cannot be updated. policy/modules/system/selinuxutil.if | 23 +++++++++++++++++++++++ policy/modules/system/selinuxutil.te | 1 + 2 files changed, 24 insertions(+) diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if index b4c70a3..a8221f0 100644 --- a/policy/modules/system/selinuxutil.if +++ b/policy/modules/system/selinuxutil.if @@ -1107,6 +1107,29 @@ interface(`seutil_run_semanage',` ######################################## ## +## Read the semanage module store. +## +## +## +## Domain allowed access. +## +## +# +interface(`seutil_read_module_store',` + gen_require(` + type selinux_config_t, semanage_store_t; + ') + + files_search_etc($1) + files_search_var($1) + list_dirs_pattern($1, selinux_config_t, semanage_store_t) + list_dirs_pattern($1, semanage_store_t, semanage_store_t) + read_files_pattern($1, semanage_store_t, semanage_store_t) + read_lnk_files_pattern($1, semanage_store_t, semanage_store_t) +') + +######################################## +## ## Full management of the semanage ## module store. ## diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te index 4a100cd..98d7840 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -597,6 +597,7 @@ logging_send_syslog_msg(setfiles_t) miscfiles_read_localization(setfiles_t) seutil_libselinux_linked(setfiles_t) +seutil_read_module_store(setfiles_t) userdom_use_all_users_fds(setfiles_t) # for config files in a home directory