@@ -13,7 +13,6 @@ domains are unconfined. \
SRC_URI += " \
file://0001-refpolicy-minimum-make-sysadmin-module-optional.patch \
- file://0002-refpolicy-minimum-make-xdg-module-optional.patch \
"
POLICY_NAME = "minimum"
deleted file mode 100644
@@ -1,40 +0,0 @@
-From 39b825d24a34864c3d9bae684b083a9b656f641a Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Wed, 29 Sep 2021 11:08:49 +0800
-Subject: [PATCH] refpolicy-minimum: make xdg module optional
-
-The systemd module invokes xdg_config_content and xdg_data_content
-interfaces which are from xdg module. Since xdg is not a core module, we
-could make it optional in minimum policy.
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/systemd.te | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index a0e6bb405..b1fc414ea 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -313,10 +313,14 @@ init_unit_file(systemd_user_manager_unit_t)
-
- type systemd_conf_home_t;
- init_unit_file(systemd_conf_home_t)
--xdg_config_content(systemd_conf_home_t)
-+optional_policy(`
-+ xdg_config_content(systemd_conf_home_t)
-+')
-
- type systemd_data_home_t;
--xdg_data_content(systemd_data_home_t)
-+optional_policy(`
-+ xdg_data_content(systemd_data_home_t)
-+')
-
- type systemd_user_runtime_notify_t;
- userdom_user_runtime_content(systemd_user_runtime_notify_t)
-2.25.1
-
similarity index 100%
rename from recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-grant-getpcap-capabili.patch
rename to recipes-security/refpolicy/refpolicy/0040-policy-modules-system-logging-grant-getpcap-capabili.patch
deleted file mode 100644
@@ -1,38 +0,0 @@
-From 1b8a639bfdce84c9b39cd9e89b6da4c1d06cc7ab Mon Sep 17 00:00:00 2001
-From: Yi Zhao <yi.zhao@windriver.com>
-Date: Sun, 4 Feb 2024 19:40:32 +0800
-Subject: [PATCH] policy/modules/system/systemd: allow systemd-logind to
- inherit local login file descriptors
-
-Fix reboot timeout error:
-$ reboot
-Failed to set wall message, ignoring: Failed to activate service 'org.freedesktop.login1': timed out (service_start_timeout=25000ms)
-Call to Reboot failed: Failed to activate service 'org.freedesktop.login1': timed out (service_start_timeout=25000ms)
-
-avc: denied { use } for pid=287 comm="systemd-logind"
-path="anon_inode:[pidfd]" dev="anon_inodefs" ino=1044
-scontext=system_u:system_r:systemd_logind_t
-tcontext=system_u:system_r:local_login_t tclass=fd permissive=0
-
-Upstream-Status: Pending
-
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
----
- policy/modules/system/systemd.te | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index ffce3c0e8..03aeb8515 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -973,6 +973,7 @@ init_stop_system(systemd_logind_t)
- miscfiles_read_localization(systemd_logind_t)
-
- locallogin_read_state(systemd_logind_t)
-+locallogin_use_fds(systemd_logind_t)
-
- seutil_libselinux_linked(systemd_logind_t)
- seutil_read_default_contexts(systemd_logind_t)
-2.25.1
-
@@ -55,7 +55,7 @@ SRC_URI += " \
file://0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch \
file://0038-policy-modules-system-systemd-systemd-user-fixes.patch \
file://0039-policy-modules-system-authlogin-fix-login-errors-aft.patch \
- file://0040-policy-modules-system-systemd-allow-systemd-logind-t.patch \
+ file://0040-policy-modules-system-logging-grant-getpcap-capabili.patch \
file://0041-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \
file://0042-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \
file://0043-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \
@@ -72,7 +72,6 @@ SRC_URI += " \
file://0054-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \
file://0055-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
file://0056-policy-modules-system-logging-make-syslogd_runtime_t.patch \
- file://0057-policy-modules-system-logging-grant-getpcap-capabili.patch \
"
S = "${WORKDIR}/refpolicy"
@@ -2,7 +2,7 @@ PV = "2.20240226+git"
SRC_URI = "git://github.com/SELinuxProject/refpolicy.git;protocol=https;branch=main;name=refpolicy;destsuffix=refpolicy"
-SRCREV_refpolicy ?= "c920fc5d9e626874b9af8693e5aa697200f76a12"
+SRCREV_refpolicy ?= "71f4bd1992e05bcd79dc5234f8a30deeb141aa3d"
UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P<pver>\d+_\d+)"
* a6cf20736 filesystem, devices: move gadgetfs to usbfs_t * 75492f95f systemd: make xdg optional * 097d688ff sshd: label sshd-session as sshd_exec_t * b57b6005c Setting bluetooth helper domain for bluetoothctl * 30f451d6a Adding Sepolicy rules to allow pulseaudio to access bluetooth sockets. * 7037c341f systemd: allow logind to use locallogin pidfds * 5f7f494d1 userdomain: allow administrative user to get attributes of shadow history file * 0126cb1e6 node_exporter: allow reading RPC sysctls * 9c90f9f7d asterisk: allow reading certbot lib * bfcaec9ba postfix: allow postfix pipe to watch mail spool * 06a80c3d8 netutils: allow ping to read net sysctls * 2e0509c9e node_exporter: allow reading localization * 50a8cddd1 container: allow containers to execute tmpfs files * 09a747a16 sysadm: make haproxy admin * c8c3ae2cb haproxy: initial policy * 4e97f87ce init: use pidfds from local login * 7fd9032d8 dbus, init: add interface for pidfd usage * a6d6921a9 asterisk: allow watching spool dirs * 72c1d912f su, sudo: allow sudo to signal all su domains * 8b3178248 sudo: allow systemd-logind to read cgroup state of sudo * 871f0b0dd postfix: allow smtpd to mmap SASL keytab files * 578375480 sysnetwork: allow ifconfig to read usr files * 6916e9b20 systemd: allow systemd-logind to use sshd pidfds * 96ebb7c4e Reorder perms and classes * cb68df087 tests.yml: Add policy diff on PRs. * 99258825c tests.yml: Divide into reusable workflows. * 1e4b68930 Reorder perms and classes Drop 0002-refpolicy-minimum-make-xdg-module-optional.patch and 0040-policy-modules-system-systemd-allow-systemd-logind-t.patch which have been merged upstream. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> --- .../refpolicy/refpolicy-minimum_git.bb | 1 - ...icy-minimum-make-xdg-module-optional.patch | 40 ------------------- ...stem-logging-grant-getpcap-capabili.patch} | 0 ...ystem-systemd-allow-systemd-logind-t.patch | 38 ------------------ .../refpolicy/refpolicy_common.inc | 3 +- recipes-security/refpolicy/refpolicy_git.inc | 2 +- 6 files changed, 2 insertions(+), 82 deletions(-) delete mode 100644 recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-make-xdg-module-optional.patch rename recipes-security/refpolicy/refpolicy/{0057-policy-modules-system-logging-grant-getpcap-capabili.patch => 0040-policy-modules-system-logging-grant-getpcap-capabili.patch} (100%) delete mode 100644 recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd-logind-t.patch