diff mbox series

[meta-selinux,master,scarthgap] refpolicy: update to latest git rev

Message ID 20240724053855.2843635-1-yi.zhao@windriver.com
State New
Headers show
Series [meta-selinux,master,scarthgap] refpolicy: update to latest git rev | expand

Commit Message

Yi Zhao July 24, 2024, 5:38 a.m. UTC 
* a6cf20736 filesystem, devices: move gadgetfs to usbfs_t
* 75492f95f systemd: make xdg optional
* 097d688ff sshd: label sshd-session as sshd_exec_t
* b57b6005c Setting bluetooth helper domain for bluetoothctl
* 30f451d6a Adding Sepolicy rules to allow pulseaudio to access
            bluetooth sockets.
* 7037c341f systemd: allow logind to use locallogin pidfds
* 5f7f494d1 userdomain: allow administrative user to get attributes of
            shadow history file
* 0126cb1e6 node_exporter: allow reading RPC sysctls
* 9c90f9f7d asterisk: allow reading certbot lib
* bfcaec9ba postfix: allow postfix pipe to watch mail spool
* 06a80c3d8 netutils: allow ping to read net sysctls
* 2e0509c9e node_exporter: allow reading localization
* 50a8cddd1 container: allow containers to execute tmpfs files
* 09a747a16 sysadm: make haproxy admin
* c8c3ae2cb haproxy: initial policy
* 4e97f87ce init: use pidfds from local login
* 7fd9032d8 dbus, init: add interface for pidfd usage
* a6d6921a9 asterisk: allow watching spool dirs
* 72c1d912f su, sudo: allow sudo to signal all su domains
* 8b3178248 sudo: allow systemd-logind to read cgroup state of sudo
* 871f0b0dd postfix: allow smtpd to mmap SASL keytab files
* 578375480 sysnetwork: allow ifconfig to read usr files
* 6916e9b20 systemd: allow systemd-logind to use sshd pidfds
* 96ebb7c4e Reorder perms and classes
* cb68df087 tests.yml: Add policy diff on PRs.
* 99258825c tests.yml: Divide into reusable workflows.
* 1e4b68930 Reorder perms and classes

Drop 0002-refpolicy-minimum-make-xdg-module-optional.patch and
0040-policy-modules-system-systemd-allow-systemd-logind-t.patch which
have been merged upstream.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 .../refpolicy/refpolicy-minimum_git.bb        |  1 -
 ...icy-minimum-make-xdg-module-optional.patch | 40 -------------------
 ...stem-logging-grant-getpcap-capabili.patch} |  0
 ...ystem-systemd-allow-systemd-logind-t.patch | 38 ------------------
 .../refpolicy/refpolicy_common.inc            |  3 +-
 recipes-security/refpolicy/refpolicy_git.inc  |  2 +-
 6 files changed, 2 insertions(+), 82 deletions(-)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch
 rename recipes-security/refpolicy/refpolicy/{0057-policy-modules-system-logging-grant-getpcap-capabili.patch => 0040-policy-modules-system-logging-grant-getpcap-capabili.patch} (100%)
 delete mode 100644 recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch
diff mbox series

Patch

diff --git a/recipes-security/refpolicy/refpolicy-minimum_git.bb b/recipes-security/refpolicy/refpolicy-minimum_git.bb
index 67c3785..562ccac 100644
--- a/recipes-security/refpolicy/refpolicy-minimum_git.bb
+++ b/recipes-security/refpolicy/refpolicy-minimum_git.bb
@@ -13,7 +13,6 @@  domains are unconfined. \
 
 SRC_URI += " \
         file://0001-refpolicy-minimum-make-sysadmin-module-optional.patch \
-        file://0002-refpolicy-minimum-make-xdg-module-optional.patch \
         "
 
 POLICY_NAME = "minimum"
diff --git a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch b/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch
deleted file mode 100644
index cc8c0b7..0000000
--- a/recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch
+++ /dev/null
@@ -1,40 +0,0 @@ 
-From 39b825d24a34864c3d9bae684b083a9b656f641a Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Wed, 29 Sep 2021 11:08:49 +0800
-Subject: [PATCH] refpolicy-minimum: make xdg module optional
-
-The systemd module invokes xdg_config_content and xdg_data_content
-interfaces which are from xdg module. Since xdg is not a core module, we
-could make it optional in minimum policy.
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/systemd.te | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index a0e6bb405..b1fc414ea 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -313,10 +313,14 @@ init_unit_file(systemd_user_manager_unit_t)
- 
- type systemd_conf_home_t;
- init_unit_file(systemd_conf_home_t)
--xdg_config_content(systemd_conf_home_t)
-+optional_policy(`
-+	xdg_config_content(systemd_conf_home_t)
-+')
- 
- type systemd_data_home_t;
--xdg_data_content(systemd_data_home_t)
-+optional_policy(`
-+	xdg_data_content(systemd_data_home_t)
-+')
- 
- type systemd_user_runtime_notify_t;
- userdom_user_runtime_content(systemd_user_runtime_notify_t)
--- 
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-grant-getpcap-capabili.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-logging-grant-getpcap-capabili.patch
similarity index 100%
rename from recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-grant-getpcap-capabili.patch
rename to recipes-security/refpolicy/refpolicy/0040-policy-modules-system-logging-grant-getpcap-capabili.patch
diff --git a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch
deleted file mode 100644
index 4322590..0000000
--- a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch
+++ /dev/null
@@ -1,38 +0,0 @@ 
-From 1b8a639bfdce84c9b39cd9e89b6da4c1d06cc7ab Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Sun, 4 Feb 2024 19:40:32 +0800
-Subject: [PATCH] policy/modules/system/systemd: allow systemd-logind to
- inherit local login file descriptors
-
-Fix reboot timeout error:
-$ reboot
-Failed to set wall message, ignoring: Failed to activate service 'org.freedesktop.login1': timed out (service_start_timeout=25000ms)
-Call to Reboot failed: Failed to activate service 'org.freedesktop.login1': timed out (service_start_timeout=25000ms)
-
-avc:  denied  { use } for  pid=287 comm="systemd-logind"
-path="anon_inode:[pidfd]" dev="anon_inodefs" ino=1044
-scontext=system_u:system_r:systemd_logind_t
-tcontext=system_u:system_r:local_login_t tclass=fd permissive=0
-
-Upstream-Status: Pending
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/systemd.te | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index ffce3c0e8..03aeb8515 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -973,6 +973,7 @@ init_stop_system(systemd_logind_t)
- miscfiles_read_localization(systemd_logind_t)
- 
- locallogin_read_state(systemd_logind_t)
-+locallogin_use_fds(systemd_logind_t)
- 
- seutil_libselinux_linked(systemd_logind_t)
- seutil_read_default_contexts(systemd_logind_t)
--- 
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index 05dca2c..7b45882 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -55,7 +55,7 @@  SRC_URI += " \
         file://0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch \
         file://0038-policy-modules-system-systemd-systemd-user-fixes.patch \
         file://0039-policy-modules-system-authlogin-fix-login-errors-aft.patch \
-        file://0040-policy-modules-system-systemd-allow-systemd-logind-t.patch \
+        file://0040-policy-modules-system-logging-grant-getpcap-capabili.patch \
         file://0041-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \
         file://0042-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \
         file://0043-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \
@@ -72,7 +72,6 @@  SRC_URI += " \
         file://0054-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \
         file://0055-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
         file://0056-policy-modules-system-logging-make-syslogd_runtime_t.patch \
-        file://0057-policy-modules-system-logging-grant-getpcap-capabili.patch \
         "
 
 S = "${WORKDIR}/refpolicy"
diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc
index ee69664..80d92ac 100644
--- a/recipes-security/refpolicy/refpolicy_git.inc
+++ b/recipes-security/refpolicy/refpolicy_git.inc
@@ -2,7 +2,7 @@  PV = "2.20240226+git"
 
 SRC_URI = "git://github.com/SELinuxProject/refpolicy.git;protocol=https;branch=main;name=refpolicy;destsuffix=refpolicy"
 
-SRCREV_refpolicy ?= "c920fc5d9e626874b9af8693e5aa697200f76a12"
+SRCREV_refpolicy ?= "71f4bd1992e05bcd79dc5234f8a30deeb141aa3d"
 
 UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P<pver>\d+_\d+)"