@@ -13,6 +13,7 @@ domains are unconfined. \
SRC_URI += " \
file://0001-refpolicy-minimum-make-sysadmin-module-optional.patch \
+ file://0002-refpolicy-minimum-enable-nscd_use_shm.patch \
"
POLICY_NAME = "minimum"
@@ -1,4 +1,4 @@
-From 9fdb576862d6a373b4a50e149fcfd4571e01dd1a Mon Sep 17 00:00:00 2001
+From 2627c403bb84d710a2469e501e6a0ccf5c7fb438 Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 28 Mar 2019 16:14:09 -0400
Subject: [PATCH] fc/subs/volatile: alias common /var/volatile paths
@@ -1,4 +1,4 @@
-From 2d04fadd54814ce01d143262f36edbf0b1700a9b Mon Sep 17 00:00:00 2001
+From 923dec0f0231024680bb6f7d48ff7edf82ed8082 Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Fri, 5 Apr 2019 11:53:28 -0400
Subject: [PATCH] refpolicy-minimum: make sysadmin module optional
@@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2 files changed, 11 insertions(+), 7 deletions(-)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index c2380d8b4..31f77cf43 100644
+index 8af34aa7e..fdd64fb5b 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
-@@ -645,13 +645,15 @@ ifdef(`init_systemd',`
+@@ -653,13 +653,15 @@ ifdef(`init_systemd',`
unconfined_write_keys(init_t)
')
',`
@@ -48,7 +48,7 @@ index c2380d8b4..31f77cf43 100644
')
')
diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
-index 8330be8a9..933e94b24 100644
+index 4ba131d29..9c4b0a1d8 100644
--- a/policy/modules/system/locallogin.te
+++ b/policy/modules/system/locallogin.te
@@ -277,7 +277,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
@@ -1,4 +1,4 @@
-From 15b4f9a17d1f45dc6e15e4a3b0e6490a9a518df6 Mon Sep 17 00:00:00 2001
+From 38cac8a2f2ec94bbc9b6d04ffcc35b7459c05b11 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Mon, 20 Apr 2020 11:50:03 +0800
Subject: [PATCH] refpolicy-targeted: make unconfined_u the default selinux
@@ -38,7 +38,7 @@ index ce614b41b..c0903d98b 100644
+root:unconfined_u:s0-mcs_systemhigh
+__default__:unconfined_u:s0
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
-index 6c9769b04..01c9a7243 100644
+index 68b78ff24..d54fe2fd4 100644
--- a/policy/modules/system/unconfined.te
+++ b/policy/modules/system/unconfined.te
@@ -20,6 +20,11 @@ type unconfined_execmem_t alias ada_t;
@@ -1,4 +1,4 @@
-From a3269d08232045835f341e5796da66d9bf948aca Mon Sep 17 00:00:00 2001
+From bd8d0af36d8f6eb0f25c43b94e31e93d4ac7513b Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 28 Mar 2019 20:48:10 -0400
Subject: [PATCH] fc/subs/busybox: set aliases for bin, sbin and usr
new file mode 100644
@@ -0,0 +1,47 @@
+From 9494c078e1aea2ab6ecdf0c3ca01e2d3941b11a7 Mon Sep 17 00:00:00 2001
+From: Yi Zhao <yi.zhao@windriver.com>
+Date: Fri, 26 Feb 2021 09:13:23 +0800
+Subject: [PATCH] refpolicy-minimum: enable nscd_use_shm
+
+Fixes:
+avc: denied { listen } for pid=340 comm="systemd-network"
+path="/run/systemd/netif/io.systemd.Network"
+scontext=system_u:system_r:systemd_networkd_t:s0
+tcontext=system_u:system_r:systemd_networkd_t:s0
+tclass=unix_stream_socket permissive=1
+
+avc: denied { accept } for pid=312 comm="systemd-nsresou"
+path="/run/systemd/io.systemd.NamespaceResource"
+scontext=system_u:system_r:systemd_nsresourced_t:s0
+tcontext=system_u:system_r:systemd_nsresourced_t:s0
+tclass=unix_stream_socket permissive=1
+
+avc: denied { accept } for pid=309 comm="systemd-nsresou"
+path="/run/systemd/io.systemd.NamespaceResource"
+scontext=system_u:system_r:systemd_nsresourced_t:s0
+tcontext=system_u:system_r:systemd_nsresourced_t:s0
+tclass=unix_stream_socket permissive=1
+
+Upstream-Status: Inappropriate [embedded specific]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ policy/modules/services/nscd.te | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/policy/modules/services/nscd.te b/policy/modules/services/nscd.te
+index ffc60497c..d226f1145 100644
+--- a/policy/modules/services/nscd.te
++++ b/policy/modules/services/nscd.te
+@@ -15,7 +15,7 @@ gen_require(`
+ ## can use nscd shared memory.
+ ## </p>
+ ## </desc>
+-gen_tunable(nscd_use_shm, false)
++gen_tunable(nscd_use_shm, true)
+
+ attribute_role nscd_roles;
+
+--
+2.25.1
+
@@ -1,4 +1,4 @@
-From a78f1bf10f489d1abe8a4db9c8ee29af6ac9d02c Mon Sep 17 00:00:00 2001
+From b8ec557e6aa310c65d9183ae741e649eae1c3619 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] fc/hostname: apply policy to common yocto hostname
@@ -1,4 +1,4 @@
-From 0f549b970d42109994c5736e78f0b7d9267b1ae5 Mon Sep 17 00:00:00 2001
+From ddba777d85a78cb372a84f4ff003888e1ba06afa Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 28 Mar 2019 21:37:32 -0400
Subject: [PATCH] fc/bash: apply /usr/bin/bash context to /bin/bash.bash
@@ -1,4 +1,4 @@
-From d9348cee43dd6d6e2ea971ef22c796956b9677fd Mon Sep 17 00:00:00 2001
+From 3f24037dd9c0c468d4182d6b047a9baa2469726a Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 4 Apr 2019 10:45:03 -0400
Subject: [PATCH] fc/resolv.conf: label resolv.conf in var/run/ properly
@@ -13,10 +13,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
-index 14505efe9..c9ec4e5ab 100644
+index d792422f5..a20f74820 100644
--- a/policy/modules/system/sysnetwork.fc
+++ b/policy/modules/system/sysnetwork.fc
-@@ -84,6 +84,7 @@ ifdef(`distro_redhat',`
+@@ -85,6 +85,7 @@ ifdef(`distro_redhat',`
/run/dhcpcd(/.*)? gen_context(system_u:object_r:dhcpc_runtime_t,s0)
/run/netns -d gen_context(system_u:object_r:ifconfig_runtime_t,s0)
/run/netns/[^/]+ -- <<none>>
@@ -1,4 +1,4 @@
-From df2801c3f9689d6c173dca05ee970756ba3b3d04 Mon Sep 17 00:00:00 2001
+From b318d4d8feb1a021e63d38ac2bea4abe834c4e3b Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 28 Mar 2019 21:43:53 -0400
Subject: [PATCH] fc/login: apply login context to login.shadow
@@ -12,7 +12,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc
-index adb53a05a..a25a9d607 100644
+index fcdd38d6d..c7e7b64a9 100644
--- a/policy/modules/system/authlogin.fc
+++ b/policy/modules/system/authlogin.fc
@@ -8,6 +8,7 @@
@@ -1,4 +1,4 @@
-From f274bbf18ef930a506c7fe7cc90c32698e51b318 Mon Sep 17 00:00:00 2001
+From 78e157da0424e06347030577dcdd00f3e6c085ef Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Thu, 28 Mar 2019 21:59:18 -0400
Subject: [PATCH] fc/hwclock: add hwclock alternatives
@@ -1,4 +1,4 @@
-From c69e143640f73d13d82aa6cfcbfce64a02bcb13d Mon Sep 17 00:00:00 2001
+From d15ee4e3684c52af2caa3af2c24af73ab7ceb677 Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Fri, 29 Mar 2019 08:26:55 -0400
Subject: [PATCH] fc/dmesg: apply policy to dmesg alternatives
@@ -1,4 +1,4 @@
-From 6cb433b296b2085bf1aa54c7722a8bcf7a69cba8 Mon Sep 17 00:00:00 2001
+From f287a7b6b9a41963cec1e9bf70eff99e840c9cc3 Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Fri, 29 Mar 2019 09:20:58 -0400
Subject: [PATCH] fc/ssh: apply policy to ssh alternatives
@@ -12,7 +12,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
-index 5c512e972..0448c1877 100644
+index a30d01afc..e033d1a70 100644
--- a/policy/modules/services/ssh.fc
+++ b/policy/modules/services/ssh.fc
@@ -4,6 +4,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
@@ -1,4 +1,4 @@
-From 89f23ef679f8f0f842b7b41b85c48266d292bcfc Mon Sep 17 00:00:00 2001
+From fcfd91661ea05b5967f75927116056924e972214 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Tue, 9 Jun 2015 21:22:52 +0530
Subject: [PATCH] fc/sysnetwork: apply policy to network commands alternatives
@@ -14,10 +14,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 4 insertions(+)
diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
-index c9ec4e5ab..4ca151524 100644
+index a20f74820..6f2e3f8f0 100644
--- a/policy/modules/system/sysnetwork.fc
+++ b/policy/modules/system/sysnetwork.fc
-@@ -44,6 +44,7 @@ ifdef(`distro_redhat',`
+@@ -45,6 +45,7 @@ ifdef(`distro_redhat',`
/usr/bin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
/usr/bin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/usr/bin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
@@ -25,7 +25,7 @@ index c9ec4e5ab..4ca151524 100644
/usr/bin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/usr/bin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/usr/bin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
-@@ -60,13 +61,16 @@ ifdef(`distro_redhat',`
+@@ -61,13 +62,16 @@ ifdef(`distro_redhat',`
/usr/sbin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)
/usr/sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/usr/sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
@@ -1,4 +1,4 @@
-From 2fb2dc1ab37da9d6d1f885b7f4b3eae8db66844a Mon Sep 17 00:00:00 2001
+From 6e5d4763c0e3e7b2b819694d85710128f4e0ff28 Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Fri, 29 Mar 2019 09:54:07 -0400
Subject: [PATCH] fc/rpm: apply rpm_exec policy to cpio binaries
@@ -1,4 +1,4 @@
-From 95920611d43a3e6352fc16fcac05977844d57398 Mon Sep 17 00:00:00 2001
+From ca60691cffdf516f3f09cee23874a49d890c9de8 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Thu, 13 Feb 2014 00:33:07 -0500
Subject: [PATCH] fc/su: apply policy to su alternatives
@@ -1,4 +1,4 @@
-From 8b5320fbdb29ab1bf601d9cf81ffe7ea7b9bc55f Mon Sep 17 00:00:00 2001
+From f6a42851e3abe274a733f92f90541de3047e5d74 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Mon, 27 Jan 2014 03:54:01 -0500
Subject: [PATCH] fc/fstools: fix real path for fstools
@@ -1,4 +1,4 @@
-From a733674bb530f070ce5363c0b50848d3cb4e113b Mon Sep 17 00:00:00 2001
+From eecf36ae218ee0d85fd07a14bfbcb6636ab84095 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] fc/init: fix update-alternatives for sysvinit
@@ -1,4 +1,4 @@
-From e4bdaafd9684b3b46a6d0a417967f596fbdc36c2 Mon Sep 17 00:00:00 2001
+From e26d8e3eea2cab884562793221ce9b8c39c614cc Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 10:19:54 +0800
Subject: [PATCH] fc/brctl: apply policy to brctl alternatives
@@ -1,4 +1,4 @@
-From 762b0bd9cc26627f7361d5db92ae1cb366c0858b Mon Sep 17 00:00:00 2001
+From 48b69b97a52cf782fbc54f5e55e92ee81466d0bc Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 10:21:51 +0800
Subject: [PATCH] fc/corecommands: apply policy to nologin alternatives
@@ -1,4 +1,4 @@
-From d312aa5ea1da9c19eb214a55acb2d2b5347ed68f Mon Sep 17 00:00:00 2001
+From 29e16342861e11d6463ec63ffbe55d1665d05e7d Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 10:43:28 +0800
Subject: [PATCH] fc/locallogin: apply policy to sulogin alternatives
@@ -1,4 +1,4 @@
-From 3085ae26b66d82f7c7b3db507153a5976ec26b48 Mon Sep 17 00:00:00 2001
+From c1847b18ed1b1a18dbafc735bfb1368c2abb9d55 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 10:45:23 +0800
Subject: [PATCH] fc/ntp: apply policy to ntpd alternatives
@@ -1,4 +1,4 @@
-From 4f377178aff842dc4ce9c6e705a761478d21f4d3 Mon Sep 17 00:00:00 2001
+From 1400afd28f2cd886bae487fb17811a5fd98b86b9 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 10:55:05 +0800
Subject: [PATCH] fc/kerberos: apply policy to kerberos alternatives
@@ -1,4 +1,4 @@
-From 6de6e53b41602b50ebec3627ceede5e13bad3bb6 Mon Sep 17 00:00:00 2001
+From 53370099eb97c008460bb7b99817737beb94a9bf Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 11:06:13 +0800
Subject: [PATCH] fc/ldap: apply policy to ldap alternatives
@@ -1,4 +1,4 @@
-From f523a63f9f209544b9a557e76e94354c23d93959 Mon Sep 17 00:00:00 2001
+From 67fda1f031d70d1281b058a5f3a31e220b052d21 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 11:13:16 +0800
Subject: [PATCH] fc/postgresql: apply policy to postgresql alternatives
@@ -1,4 +1,4 @@
-From 57c6a0e69aa9d308ec23dc60dc2420ee5c62bf7f Mon Sep 17 00:00:00 2001
+From fb72a7ca4963a7537bcb98a730025f6f8941d146 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 11:15:33 +0800
Subject: [PATCH] fc/screen: apply policy to screen alternatives
@@ -1,4 +1,4 @@
-From f0706a85dca8801d87130102b701c7bc2fd7476d Mon Sep 17 00:00:00 2001
+From 343389daef155325172928f7d5608e638897775d Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 11:25:34 +0800
Subject: [PATCH] fc/usermanage: apply policy to usermanage alternatives
@@ -1,4 +1,4 @@
-From 2ff44df5a5da2246f2198741a05786e89ac9f4e3 Mon Sep 17 00:00:00 2001
+From 23cef56ad581ee4579ab6ee26c9dd8b114816b6b Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 15 Nov 2019 16:07:30 +0800
Subject: [PATCH] fc/getty: add file context to start_getty
@@ -1,4 +1,4 @@
-From 42676d53a9c8554ac3e05f826f23792edf8d3c27 Mon Sep 17 00:00:00 2001
+From 32988df0a389ef480334dffce4d5cc96b0f1012e Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Wed, 18 Dec 2019 15:04:41 +0800
Subject: [PATCH] fc/vlock: apply policy to vlock alternatives
@@ -1,4 +1,4 @@
-From 3cf1f270369d7a2c75faf1a90d1485fe699dbbfe Mon Sep 17 00:00:00 2001
+From 8586fbe84abd716a425e13e8b48179a08e210db2 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Tue, 30 Jun 2020 10:45:57 +0800
Subject: [PATCH] fc: add fcontext for init scripts and systemd service files
@@ -1,4 +1,4 @@
-From 8b5ff44ba4a7819efb694cba6237bc572835628b Mon Sep 17 00:00:00 2001
+From 20f43a932c5f7369a446707624d12285035b72fc Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Sun, 5 Apr 2020 22:03:45 +0800
Subject: [PATCH] file_contexts.subs_dist: set aliase for /root directory
@@ -1,4 +1,4 @@
-From 6f73afe1d8647bd917f6c06b46b0f0cebc276776 Mon Sep 17 00:00:00 2001
+From 97839d4388be64e168613c2ea3202a76e58fb656 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] policy/modules/system/logging: add rules for the symlink of
@@ -30,7 +30,7 @@ index 0ce2bec4b..8957366b0 100644
/var/log/dmesg -- gen_context(system_u:object_r:var_log_t,s0)
/var/log/syslog -- gen_context(system_u:object_r:var_log_t,s0)
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
-index 49028a0cb..4381d2e83 100644
+index 7487a7053..6acf1f52b 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -1091,10 +1091,12 @@ interface(`logging_append_all_inherited_logs',`
@@ -1,4 +1,4 @@
-From 9d4f8d201dbdea28a38b5faaef9abc016bcbaab3 Mon Sep 17 00:00:00 2001
+From 9bd0c30476615fd4af29a9dd5b3b664398a9845a Mon Sep 17 00:00:00 2001
From: Joe MacDonald <joe_macdonald@mentor.com>
Date: Fri, 29 Mar 2019 10:33:18 -0400
Subject: [PATCH] policy/modules/system/logging: add rules for syslogd symlink
@@ -18,7 +18,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 9d9a01fcc..45584dba6 100644
+index eea78ffc5..5f06428f1 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -425,6 +425,7 @@ files_search_spool(syslogd_t)
@@ -1,4 +1,4 @@
-From 1ed2b79828a7dd08079ec111b116f6d288450662 Mon Sep 17 00:00:00 2001
+From 6293ec11e3c471b54c328f56f20c694b7287885f Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] policy/modules/kernel/files: add rules for the symlink of
@@ -30,10 +30,10 @@ index b1728d37c..c5012e6b4 100644
/tmp/\.journal <<none>>
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
-index 472b5bb38..a2aa85b1c 100644
+index 811efef94..00146fc23 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
-@@ -4819,6 +4819,7 @@ interface(`files_search_tmp',`
+@@ -4880,6 +4880,7 @@ interface(`files_search_tmp',`
')
allow $1 tmp_t:dir search_dir_perms;
@@ -41,7 +41,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
-@@ -4855,6 +4856,7 @@ interface(`files_list_tmp',`
+@@ -4916,6 +4917,7 @@ interface(`files_list_tmp',`
')
allow $1 tmp_t:dir list_dir_perms;
@@ -49,7 +49,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
-@@ -4891,6 +4893,7 @@ interface(`files_delete_tmp_dir_entry',`
+@@ -4952,6 +4954,7 @@ interface(`files_delete_tmp_dir_entry',`
')
allow $1 tmp_t:dir del_entry_dir_perms;
@@ -57,7 +57,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
-@@ -4909,6 +4912,7 @@ interface(`files_read_generic_tmp_files',`
+@@ -4970,6 +4973,7 @@ interface(`files_read_generic_tmp_files',`
')
read_files_pattern($1, tmp_t, tmp_t)
@@ -65,7 +65,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
-@@ -4927,6 +4931,7 @@ interface(`files_manage_generic_tmp_dirs',`
+@@ -4988,6 +4992,7 @@ interface(`files_manage_generic_tmp_dirs',`
')
manage_dirs_pattern($1, tmp_t, tmp_t)
@@ -73,7 +73,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
-@@ -4963,6 +4968,7 @@ interface(`files_manage_generic_tmp_files',`
+@@ -5024,6 +5029,7 @@ interface(`files_manage_generic_tmp_files',`
')
manage_files_pattern($1, tmp_t, tmp_t)
@@ -81,7 +81,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
-@@ -4999,6 +5005,7 @@ interface(`files_rw_generic_tmp_sockets',`
+@@ -5060,6 +5066,7 @@ interface(`files_rw_generic_tmp_sockets',`
')
rw_sock_files_pattern($1, tmp_t, tmp_t)
@@ -89,7 +89,7 @@ index 472b5bb38..a2aa85b1c 100644
')
########################################
-@@ -5206,6 +5213,7 @@ interface(`files_tmp_filetrans',`
+@@ -5267,6 +5274,7 @@ interface(`files_tmp_filetrans',`
')
filetrans_pattern($1, tmp_t, $2, $3, $4)
@@ -1,4 +1,4 @@
-From 5b33f07f60b20eb6e07ea3f517c43a539ee21332 Mon Sep 17 00:00:00 2001
+From 40ddb313a0cb04b3e9b180e04d3427715de58aee Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] policy/modules/system/logging: fix auditd startup failures
@@ -17,7 +17,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 45584dba6..4fb2fb63c 100644
+index 5f06428f1..3ffddcb0a 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -117,6 +117,7 @@ allow auditctl_t self:netlink_audit_socket nlmsg_readpriv;
@@ -1,4 +1,4 @@
-From 3da00356bee8be72115652850d535c9ec5f1b333 Mon Sep 17 00:00:00 2001
+From 857a2cf93f6194d04ae8d2a8a544422e8a021e85 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] policy/modules/kernel/terminal: don't audit tty_device_t in
@@ -17,7 +17,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 3 insertions(+)
diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
-index e5645c7c5..6e9f654ac 100644
+index 4db1fd773..f3431fa21 100644
--- a/policy/modules/kernel/terminal.if
+++ b/policy/modules/kernel/terminal.if
@@ -335,9 +335,12 @@ interface(`term_use_console',`
similarity index 94%
rename from recipes-security/refpolicy/refpolicy/0034-policy-modules-system-systemd-enable-support-for-sys.patch
rename to recipes-security/refpolicy/refpolicy/0033-policy-modules-system-systemd-enable-support-for-sys.patch
@@ -1,4 +1,4 @@
-From 59b8730de7af45617a6125c7e23cecf896c30ce4 Mon Sep 17 00:00:00 2001
+From 44fe25734126ae52d95456992d6a5257bb28a5c2 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Thu, 4 Feb 2016 06:03:19 -0500
Subject: [PATCH] policy/modules/system/systemd: enable support for
@@ -29,7 +29,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index aa9198591..abc324cf1 100644
+index d58aba30b..8ae917644 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -10,7 +10,7 @@ policy_module(systemd)
similarity index 93%
rename from recipes-security/refpolicy/refpolicy/0035-policy-modules-system-logging-allow-systemd-tmpfiles.patch
rename to recipes-security/refpolicy/refpolicy/0034-policy-modules-system-logging-allow-systemd-tmpfiles.patch
@@ -1,4 +1,4 @@
-From feb50cfed6d7a08bb4e61b47f95df729a4fba9ea Mon Sep 17 00:00:00 2001
+From 07582b5efbc4fd199e80d9cc9b8144e4c88e0a2b Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Sat, 30 Sep 2023 17:20:29 +0800
Subject: [PATCH] policy/modules/system/logging: allow systemd-tmpfiles to
@@ -24,7 +24,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 4 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 8bc70b81d..3cab14381 100644
+index 3ffddcb0a..df6095805 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -27,6 +27,10 @@ type auditd_log_t;
similarity index 89%
rename from recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
rename to recipes-security/refpolicy/refpolicy/0035-policy-modules-system-systemd-allow-systemd_logind_t.patch
@@ -1,4 +1,4 @@
-From c21d5186e0625fd83c9d674c3284cfd98c2f02b9 Mon Sep 17 00:00:00 2001
+From 13ad5906311d8e0be5547326c106d9b5ce8481ab Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Sat, 18 Dec 2021 09:26:43 +0800
Subject: [PATCH] policy/modules/system/systemd: allow systemd_logind_t to read
@@ -27,10 +27,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index abc324cf1..ffce3c0e8 100644
+index 8ae917644..9375e8926 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
-@@ -1006,6 +1006,7 @@ userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
+@@ -1056,6 +1056,7 @@ userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
userdom_relabelto_user_runtime_dirs(systemd_logind_t)
userdom_setattr_user_ttys(systemd_logind_t)
userdom_use_user_ttys(systemd_logind_t)
similarity index 91%
rename from recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
rename to recipes-security/refpolicy/refpolicy/0036-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
@@ -1,4 +1,4 @@
-From e561ad9a73c949768f0b4e91943a32f10a9f4acc Mon Sep 17 00:00:00 2001
+From be2a2d244fd95e4207986fa095988a02cb33cb32 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 28 Oct 2022 11:56:09 +0800
Subject: [PATCH] policy/modules/roles/sysadm: allow sysadm to use init file
@@ -19,7 +19,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
-index 08cc0e117..c08226dc3 100644
+index 69777df20..af5ccca9d 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -95,6 +95,8 @@ ifdef(`init_systemd',`
similarity index 90%
rename from recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch
rename to recipes-security/refpolicy/refpolicy/0037-policy-modules-system-systemd-systemd-user-fixes.patch
@@ -1,4 +1,4 @@
-From 33164c889a759f4d4f2dc31244b9e2937cba854f Mon Sep 17 00:00:00 2001
+From d57677139a8fc837ede3430986bea0c42f49fc97 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Thu, 4 Feb 2021 10:48:54 +0800
Subject: [PATCH] policy/modules/system/systemd: systemd --user fixes
@@ -31,10 +31,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2 files changed, 34 insertions(+)
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
-index 28f0ad089..d7219dc37 100644
+index e62e8344a..96b5d31b4 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
-@@ -228,6 +228,36 @@ template(`systemd_role_template',`
+@@ -230,6 +230,36 @@ template(`systemd_role_template',`
')
')
@@ -72,10 +72,10 @@ index 28f0ad089..d7219dc37 100644
## <summary>
## Allow the specified domain to be started as a daemon by the
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
-index 088cb87b2..504747917 100644
+index 73bb7c410..ea7a90a5d 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
-@@ -1464,6 +1464,10 @@ template(`userdom_admin_user_template',`
+@@ -1467,6 +1467,10 @@ template(`userdom_admin_user_template',`
optional_policy(`
userhelper_exec($1_t)
')
similarity index 90%
rename from recipes-security/refpolicy/refpolicy/0040-policy-modules-system-logging-grant-getpcap-capabili.patch
rename to recipes-security/refpolicy/refpolicy/0038-policy-modules-system-logging-grant-getpcap-capabili.patch
@@ -1,4 +1,4 @@
-From f48edb588d799a7aab9110e4f67468d8e5e41c10 Mon Sep 17 00:00:00 2001
+From c54c53f8765c4401aa4c1b4a6204c8b538c008ad Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Tue, 28 May 2024 11:21:48 +0800
Subject: [PATCH] policy/modules/system/logging: grant getpcap capability to
@@ -21,10 +21,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 511604493..9c0a58aef 100644
+index df6095805..086498936 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
-@@ -404,6 +404,8 @@ optional_policy(`
+@@ -402,6 +402,8 @@ optional_policy(`
# sys_admin for the integrated klog of syslog-ng and metalog
# sys_nice for rsyslog
allow syslogd_t self:capability { chown dac_override fsetid setgid setuid sys_admin sys_nice sys_resource sys_tty_config };
similarity index 93%
rename from recipes-security/refpolicy/refpolicy/0057-Allow-services-to-read-tmpfs-under-run-credentials.patch
rename to recipes-security/refpolicy/refpolicy/0039-policy-modules-system-allow-services-to-read-tmpfs-u.patch
@@ -1,7 +1,8 @@
-From be681d155c6c62a2ec4939dedc921921fe73e277 Mon Sep 17 00:00:00 2001
+From 33bc8d28c406ffd7a6aef2f390734b3f5bdfc5a3 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Fri, 30 Aug 2024 12:39:48 +0800
-Subject: [PATCH] Allow services to read tmpfs under /run/credentials/
+Subject: [PATCH] policy/modules/system: allow services to read tmpfs under
+ /run/credentials/
$ mount | grep credentials
tmpfs on /run/credentials/systemd-journald.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,seclabel,size=1024k,nr_inodes=1024,mode=700,noswap)
@@ -66,10 +67,10 @@ index a900226bf..75b94785b 100644
mcs_process_set_categories(getty_t)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index fc73825fa..d5878876b 100644
+index 086498936..dca46f105 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
-@@ -495,6 +495,7 @@ files_read_kernel_symbol_table(syslogd_t)
+@@ -491,6 +491,7 @@ files_read_kernel_symbol_table(syslogd_t)
files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir })
fs_getattr_all_fs(syslogd_t)
@@ -78,10 +79,10 @@ index fc73825fa..d5878876b 100644
mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 22a319c36..0440b4795 100644
+index 9375e8926..24fc90838 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
-@@ -1303,6 +1303,7 @@ files_watch_root_dirs(systemd_networkd_t)
+@@ -1294,6 +1294,7 @@ files_watch_root_dirs(systemd_networkd_t)
files_list_runtime(systemd_networkd_t)
fs_getattr_all_fs(systemd_networkd_t)
new file mode 100644
@@ -0,0 +1,39 @@
+From 58adf54a5ef927cda85c11e2c73151d6e91e8294 Mon Sep 17 00:00:00 2001
+From: Yi Zhao <yi.zhao@windriver.com>
+Date: Thu, 3 Oct 2024 21:12:33 +0800
+Subject: [PATCH] policy/modules/kernel/domain: allow all domains to connect to
+ systemd-nsresourced over a unix socket
+
+Refer to Fedora selinux policy[1], allow all domains to connect to
+systemd-nsresourced over a unix socket.
+
+As said in [2]: Each subsystem that needs to define users and groups on
+the local system is supposed to implement this API, and offer its
+interfaces on a Varlink AF_UNIX/SOCK_STREAM file system socket bound
+into the /run/systemd/userdb/ directory.
+
+[1] https://github.com/fedora-selinux/selinux-policy/commit/8c784a48c0833a83de9d2d120f4cb76f0d87895c
+[2] https://systemd.io/USER_GROUP_API/
+
+Upstream-Status: Pending
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ policy/modules/kernel/domain.te | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
+index 0f38015b6..e3eee0590 100644
+--- a/policy/modules/kernel/domain.te
++++ b/policy/modules/kernel/domain.te
+@@ -131,6 +131,7 @@ files_list_root(domain)
+ ifdef(`init_systemd',`
+ optional_policy(`
+ shutdown_sigchld(domain)
++ systemd_stream_connect_nsresourced(domain)
+ ')
+ ')
+
+--
+2.25.1
+
@@ -1,4 +1,4 @@
-From 53a770736133d84be9cab23732811f96304bf737 Mon Sep 17 00:00:00 2001
+From fe5fe08deab5f02a3609e5333e09e5e3af05140a Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Sat, 15 Feb 2014 04:22:47 -0500
Subject: [PATCH] policy/modules/system/mount: make mount_t domain MLS trusted
@@ -19,10 +19,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
-index 8cd51d563..3fc37619e 100644
+index d9e431a84..20d6aaba1 100644
--- a/policy/modules/system/mount.te
+++ b/policy/modules/system/mount.te
-@@ -117,6 +117,7 @@ fs_dontaudit_write_all_image_files(mount_t)
+@@ -118,6 +118,7 @@ fs_dontaudit_write_all_image_files(mount_t)
mls_file_read_all_levels(mount_t)
mls_file_write_all_levels(mount_t)
@@ -1,4 +1,4 @@
-From 93225203c2a3a767cd1319d6620da1fd1f91b25f Mon Sep 17 00:00:00 2001
+From 7a0339aeba7cfe38b62c81ee4074446bba60e801 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Mon, 28 Jan 2019 14:05:18 +0800
Subject: [PATCH] policy/modules/roles/sysadm: MLS - sysadm rw to clearance
@@ -23,7 +23,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
-index c08226dc3..4f3207d52 100644
+index af5ccca9d..10cebdc53 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -48,6 +48,8 @@ logging_watch_all_logs(sysadm_t)
@@ -1,4 +1,4 @@
-From 3b260a0dc07f61b9bf873a8ac976430c80a653c3 Mon Sep 17 00:00:00 2001
+From a563f59fe223aa9c74df7a482b5da80ce05fbbf5 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Fri, 23 Aug 2013 12:01:53 +0800
Subject: [PATCH] policy/modules/services/rpc: make nfsd_t domain MLS trusted
@@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2 files changed, 7 insertions(+)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index 887ca3332..f6ca775e6 100644
+index 8fd1875d3..6c35a2374 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
-@@ -380,6 +380,8 @@ mls_process_read_all_levels(kernel_t)
+@@ -381,6 +381,8 @@ mls_process_read_all_levels(kernel_t)
mls_process_write_all_levels(kernel_t)
mls_file_write_all_levels(kernel_t)
mls_file_read_all_levels(kernel_t)
@@ -28,7 +28,7 @@ index 887ca3332..f6ca775e6 100644
ifdef(`distro_redhat',`
# Bugzilla 222337
diff --git a/policy/modules/services/rpcbind.te b/policy/modules/services/rpcbind.te
-index 2a712192b..923e48db7 100644
+index 137c21ece..d2ee1edcf 100644
--- a/policy/modules/services/rpcbind.te
+++ b/policy/modules/services/rpcbind.te
@@ -73,6 +73,11 @@ logging_send_syslog_msg(rpcbind_t)
@@ -1,4 +1,4 @@
-From faad8b18adb9a4f155ec0ec6317522baffff9117 Mon Sep 17 00:00:00 2001
+From 6bd19ab1f6adac7722ef35c70982efea04b5d91f Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Tue, 30 Jun 2020 10:18:20 +0800
Subject: [PATCH] policy/modules/admin/dmesg: make dmesg_t MLS trusted reading
@@ -1,4 +1,4 @@
-From 2892de4636a61c237688d73c277edbf7a46163ab Mon Sep 17 00:00:00 2001
+From a196f11f4a7f2f96cbf05614513204ca17aa0691 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Fri, 13 Oct 2017 07:20:40 +0000
Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS trusted for
@@ -59,10 +59,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index f6ca775e6..b4b089823 100644
+index 6c35a2374..ebde22e02 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
-@@ -382,6 +382,8 @@ mls_file_write_all_levels(kernel_t)
+@@ -383,6 +383,8 @@ mls_file_write_all_levels(kernel_t)
mls_file_read_all_levels(kernel_t)
mls_socket_write_all_levels(kernel_t)
mls_fd_use_all_levels(kernel_t)
@@ -1,4 +1,4 @@
-From f2ff5081b1a98272c803ccfd24aeea91e8d5c368 Mon Sep 17 00:00:00 2001
+From 777e396d61c3af7b847fcc9ebc490f1e5f3969b9 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Fri, 15 Jan 2016 03:47:05 -0500
Subject: [PATCH] policy/modules/system/init: make init_t MLS trusted for
@@ -27,7 +27,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 4 insertions(+)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 809019873..be9c75155 100644
+index e724c295e..6ffdb547f 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -238,6 +238,10 @@ mls_process_write_all_levels(init_t)
@@ -1,4 +1,4 @@
-From 3fab5273a7721e603f2034badeaf73949aaa59a2 Mon Sep 17 00:00:00 2001
+From f87ab013d4dffe5b588376b73c51fbfc5e9b1205 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Thu, 4 Feb 2016 06:03:19 -0500
Subject: [PATCH] policy/modules/system/systemd: make systemd-tmpfiles_t domain
@@ -43,10 +43,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 5 insertions(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 03aeb8515..e483d8aea 100644
+index 24fc90838..dc3badece 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
-@@ -1877,6 +1877,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
+@@ -1970,6 +1970,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
systemd_log_parse_environment(systemd_tmpfiles_t)
@@ -1,4 +1,4 @@
-From 4eaa766ef11cb053f010bcde5121e76031aae799 Mon Sep 17 00:00:00 2001
+From ec080f2b0b18b29e46bded08a0880624e5380026 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Thu, 18 Jun 2020 09:59:58 +0800
Subject: [PATCH] policy/modules/system/systemd: systemd-*: make systemd_*_t
@@ -43,10 +43,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 12 insertions(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index e483d8aea..a0e6bb405 100644
+index dc3badece..0440b4795 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
-@@ -391,6 +391,9 @@ files_search_var_lib(systemd_backlight_t)
+@@ -430,6 +430,9 @@ files_search_var_lib(systemd_backlight_t)
fs_getattr_all_fs(systemd_backlight_t)
fs_search_cgroup_dirs(systemd_backlight_t)
@@ -56,7 +56,7 @@ index e483d8aea..a0e6bb405 100644
#######################################
#
# Binfmt local policy
-@@ -560,6 +563,9 @@ term_use_unallocated_ttys(systemd_generator_t)
+@@ -603,6 +606,9 @@ term_use_unallocated_ttys(systemd_generator_t)
udev_read_runtime_files(systemd_generator_t)
@@ -66,7 +66,7 @@ index e483d8aea..a0e6bb405 100644
ifdef(`distro_gentoo',`
corecmd_shell_entry_type(systemd_generator_t)
')
-@@ -1009,6 +1015,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
+@@ -1058,6 +1064,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
userdom_use_user_ttys(systemd_logind_t)
domain_read_all_domains_state(systemd_logind_t)
@@ -76,7 +76,7 @@ index e483d8aea..a0e6bb405 100644
# Needed to work around patch not yet merged into the systemd-logind supported on RHEL 7.x
# The change in systemd by Nicolas Iooss on 02-Feb-2016 with hash 4b51966cf6c06250036e428608da92f8640beb96
# should fix the problem where user directories in /run/user/$UID/ are not getting the proper context
-@@ -1591,6 +1600,9 @@ udev_read_runtime_files(systemd_rfkill_t)
+@@ -1681,6 +1690,9 @@ udev_read_runtime_files(systemd_rfkill_t)
systemd_log_parse_environment(systemd_rfkill_t)
@@ -1,4 +1,4 @@
-From de58aa981e1c05ce06938704089c7c87c765add6 Mon Sep 17 00:00:00 2001
+From 564d43016ed6dcbadb7a7203d8d639d0c782d4e7 Mon Sep 17 00:00:00 2001
From: Xin Ouyang <Xin.Ouyang@windriver.com>
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] policy/modules/system/logging: add the syslogd_t to trusted
@@ -18,10 +18,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 3cab14381..caf319f04 100644
+index dca46f105..cedcaeb36 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
-@@ -491,6 +491,9 @@ fs_getattr_all_fs(syslogd_t)
+@@ -495,6 +495,9 @@ fs_list_tmpfs(syslogd_t)
fs_search_auto_mountpoints(syslogd_t)
mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
@@ -1,4 +1,4 @@
-From a9ceec99a527007a91ba6685d0b86c327fbb6443 Mon Sep 17 00:00:00 2001
+From c49b89d2a6cfc33c0e6fe6347609fea09ae7fe2e Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Tue, 28 May 2019 16:41:37 +0800
Subject: [PATCH] policy/modules/system/init: make init_t MLS trusted for
@@ -17,7 +17,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index be9c75155..458906ac5 100644
+index 6ffdb547f..8bd8e2f63 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -237,6 +237,7 @@ mls_file_write_all_levels(init_t)
@@ -1,4 +1,4 @@
-From 980d9d3f3c3e1e3517971715c351ec7b747105d0 Mon Sep 17 00:00:00 2001
+From f8b5f66dd987609027d8e0381338e39b52a47138 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Wed, 3 Feb 2016 04:16:06 -0500
Subject: [PATCH] policy/modules/system/init: all init_t to read any level
@@ -22,7 +22,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 458906ac5..c2380d8b4 100644
+index 8bd8e2f63..8af34aa7e 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -243,6 +243,9 @@ mls_key_write_all_levels(init_t)
@@ -1,4 +1,4 @@
-From 2b64eabf0cf8982bbb3c537e84fc3a99085858d3 Mon Sep 17 00:00:00 2001
+From d6573102f922b0e08d49cb5582612dfbaae10600 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Thu, 25 Feb 2016 04:25:08 -0500
Subject: [PATCH] policy/modules/system/logging: allow auditd_t to write socket
@@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index caf319f04..25e1d1397 100644
+index cedcaeb36..1b181f7cc 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
-@@ -235,6 +235,8 @@ miscfiles_read_localization(auditd_t)
+@@ -236,6 +236,8 @@ miscfiles_read_localization(auditd_t)
mls_file_read_all_levels(auditd_t)
mls_file_write_all_levels(auditd_t) # Need to be able to write to /var/run/ directory
@@ -1,4 +1,4 @@
-From 35351cd7cb07622b5e43254b95d7801a5669358d Mon Sep 17 00:00:00 2001
+From 6b77c79af18f6dba52b7a63a7a2aefdd48c0fd33 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Thu, 31 Oct 2019 17:35:59 +0800
Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS trusted for
@@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 1 insertion(+)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index b4b089823..5835d28b2 100644
+index ebde22e02..60e805cb8 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
-@@ -384,6 +384,7 @@ mls_socket_write_all_levels(kernel_t)
+@@ -385,6 +385,7 @@ mls_socket_write_all_levels(kernel_t)
mls_fd_use_all_levels(kernel_t)
# https://bugzilla.redhat.com/show_bug.cgi?id=667370
mls_file_downgrade(kernel_t)
@@ -1,4 +1,4 @@
-From 6d6e2d34ec63771a01ef258c98f1ad49efdc2f67 Mon Sep 17 00:00:00 2001
+From 03e4c0afc4a0aa432b30e9b5e8abbe069871fb9e Mon Sep 17 00:00:00 2001
From: Roy Li <rongqing.li@windriver.com>
Date: Sat, 22 Feb 2014 13:35:38 +0800
Subject: [PATCH] policy/modules/system/setrans: allow setrans_t use fd at any
@@ -13,7 +13,7 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/setrans.te b/policy/modules/system/setrans.te
-index 12e66aad9..5510f7fac 100644
+index 0a87a8d70..738badc52 100644
--- a/policy/modules/system/setrans.te
+++ b/policy/modules/system/setrans.te
@@ -69,6 +69,8 @@ mls_net_receive_all_levels(setrans_t)
@@ -1,4 +1,4 @@
-From 3d5751659380eb04b63f8fc1e6113132dd1310d7 Mon Sep 17 00:00:00 2001
+From 1ca4caa4600e9b742f0c7816efe8cff153fe412a Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Mon, 22 Feb 2021 11:28:12 +0800
Subject: [PATCH] policy/modules/system/systemd: make *_systemd_t MLS trusted
@@ -24,10 +24,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
-index d7219dc37..7717e0034 100644
+index 96b5d31b4..07c506e1c 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
-@@ -226,6 +226,9 @@ template(`systemd_role_template',`
+@@ -228,6 +228,9 @@ template(`systemd_role_template',`
xdg_read_config_files($1_systemd_t)
xdg_read_data_files($1_systemd_t)
')
@@ -1,4 +1,4 @@
-From 2476910f6d7f116148bb9311498b5c98692c1ef3 Mon Sep 17 00:00:00 2001
+From 8e5a17676c9976d163b70edd31834c4e16405ed9 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Sat, 18 Dec 2021 17:31:45 +0800
Subject: [PATCH] policy/modules/system/logging: make syslogd_runtime_t MLS
@@ -31,10 +31,10 @@ Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 25e1d1397..ba0fd10e0 100644
+index 1b181f7cc..d5878876b 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
-@@ -456,6 +456,8 @@ allow syslogd_t syslogd_runtime_t:file map;
+@@ -459,6 +459,8 @@ allow syslogd_t syslogd_runtime_t:file map;
manage_files_pattern(syslogd_t, syslogd_runtime_t, syslogd_runtime_t)
files_runtime_filetrans(syslogd_t, syslogd_runtime_t, file)
@@ -48,12 +48,14 @@ SRC_URI += " \
file://0030-policy-modules-kernel-files-add-rules-for-the-symlin.patch \
file://0031-policy-modules-system-logging-fix-auditd-startup-fai.patch \
file://0032-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch \
- file://0034-policy-modules-system-systemd-enable-support-for-sys.patch \
- file://0035-policy-modules-system-logging-allow-systemd-tmpfiles.patch \
- file://0036-policy-modules-system-systemd-allow-systemd_logind_t.patch \
- file://0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch \
- file://0038-policy-modules-system-systemd-systemd-user-fixes.patch \
- file://0040-policy-modules-system-logging-grant-getpcap-capabili.patch \
+ file://0033-policy-modules-system-systemd-enable-support-for-sys.patch \
+ file://0034-policy-modules-system-logging-allow-systemd-tmpfiles.patch \
+ file://0035-policy-modules-system-systemd-allow-systemd_logind_t.patch \
+ file://0036-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch \
+ file://0037-policy-modules-system-systemd-systemd-user-fixes.patch \
+ file://0038-policy-modules-system-logging-grant-getpcap-capabili.patch \
+ file://0039-policy-modules-system-allow-services-to-read-tmpfs-u.patch \
+ file://0040-policy-modules-kernel-domain-allow-all-domains-to-co.patch \
file://0041-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \
file://0042-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \
file://0043-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \
@@ -70,7 +72,6 @@ SRC_URI += " \
file://0054-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \
file://0055-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
file://0056-policy-modules-system-logging-make-syslogd_runtime_t.patch \
- file://0057-Allow-services-to-read-tmpfs-under-run-credentials.patch \
"
S = "${WORKDIR}/refpolicy"
@@ -1,8 +1,8 @@
-PV = "2.20240226+git"
+PV = "2.20240916+git"
SRC_URI = "git://github.com/SELinuxProject/refpolicy.git;protocol=https;branch=main;name=refpolicy;destsuffix=refpolicy"
-SRCREV_refpolicy ?= "351a5a7f4dc959769aaa8fe47c6e77f94fe5b657"
+SRCREV_refpolicy ?= "741dc96eb7e737bc2f00b7f4b4b394a66d32d913"
UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P<pver>\d+_\d+)"
ChangeLog: https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20240916 Notable Changes Added sechecker configuration for GitHub CI actions. Cleaned up concerning permissions uncovered by sechecker Removed extremely deprecated domains in cups (ptal) and xen (xend/xm) Systemd updates up to v256 Various container fixes New Modules haproxy Signed-off-by: Yi Zhao <yi.zhao@windriver.com> --- .../refpolicy/refpolicy-minimum_git.bb | 1 + ...tile-alias-common-var-volatile-paths.patch | 2 +- ...inimum-make-sysadmin-module-optional.patch | 8 ++-- ...ed-make-unconfined_u-the-default-sel.patch | 4 +- ...box-set-aliases-for-bin-sbin-and-usr.patch | 2 +- ...efpolicy-minimum-enable-nscd_use_shm.patch | 47 +++++++++++++++++++ ...y-policy-to-common-yocto-hostname-al.patch | 2 +- ...sr-bin-bash-context-to-bin-bash.bash.patch | 2 +- ...abel-resolv.conf-in-var-run-properly.patch | 6 +-- ...-apply-login-context-to-login.shadow.patch | 4 +- ...-fc-hwclock-add-hwclock-alternatives.patch | 2 +- ...g-apply-policy-to-dmesg-alternatives.patch | 2 +- ...ssh-apply-policy-to-ssh-alternatives.patch | 4 +- ...ply-policy-to-network-commands-alter.patch | 8 ++-- ...ply-rpm_exec-policy-to-cpio-binaries.patch | 2 +- ...c-su-apply-policy-to-su-alternatives.patch | 2 +- ...fc-fstools-fix-real-path-for-fstools.patch | 2 +- ...fix-update-alternatives-for-sysvinit.patch | 2 +- ...l-apply-policy-to-brctl-alternatives.patch | 2 +- ...apply-policy-to-nologin-alternatives.patch | 2 +- ...apply-policy-to-sulogin-alternatives.patch | 2 +- ...tp-apply-policy-to-ntpd-alternatives.patch | 2 +- ...pply-policy-to-kerberos-alternatives.patch | 2 +- ...ap-apply-policy-to-ldap-alternatives.patch | 2 +- ...ply-policy-to-postgresql-alternative.patch | 2 +- ...-apply-policy-to-screen-alternatives.patch | 2 +- ...ply-policy-to-usermanage-alternative.patch | 2 +- ...etty-add-file-context-to-start_getty.patch | 2 +- ...k-apply-policy-to-vlock-alternatives.patch | 2 +- ...for-init-scripts-and-systemd-service.patch | 2 +- ...bs_dist-set-aliase-for-root-director.patch | 2 +- ...ystem-logging-add-rules-for-the-syml.patch | 4 +- ...ystem-logging-add-rules-for-syslogd-.patch | 4 +- ...ernel-files-add-rules-for-the-symlin.patch | 20 ++++---- ...ystem-logging-fix-auditd-startup-fai.patch | 4 +- ...ernel-terminal-don-t-audit-tty_devic.patch | 4 +- ...stem-systemd-enable-support-for-sys.patch} | 4 +- ...stem-logging-allow-systemd-tmpfiles.patch} | 4 +- ...stem-systemd-allow-systemd_logind_t.patch} | 6 +-- ...les-sysadm-allow-sysadm-to-use-init.patch} | 4 +- ...s-system-systemd-systemd-user-fixes.patch} | 10 ++-- ...stem-logging-grant-getpcap-capabili.patch} | 6 +-- ...stem-allow-services-to-read-tmpfs-u.patch} | 13 ++--- ...ernel-domain-allow-all-domains-to-co.patch | 39 +++++++++++++++ ...ystem-mount-make-mount_t-domain-MLS-.patch | 6 +-- ...oles-sysadm-MLS-sysadm-rw-to-clearan.patch | 4 +- ...ervices-rpc-make-nfsd_t-domain-MLS-t.patch | 8 ++-- ...dmin-dmesg-make-dmesg_t-MLS-trusted-.patch | 2 +- ...ernel-kernel-make-kernel_t-MLS-trust.patch | 6 +-- ...ystem-init-make-init_t-MLS-trusted-f.patch | 4 +- ...ystem-systemd-make-systemd-tmpfiles_.patch | 6 +-- ...ystem-systemd-systemd-make-systemd_-.patch | 12 ++--- ...ystem-logging-add-the-syslogd_t-to-t.patch | 6 +-- ...ystem-init-make-init_t-MLS-trusted-f.patch | 4 +- ...ystem-init-all-init_t-to-read-any-le.patch | 4 +- ...ystem-logging-allow-auditd_t-to-writ.patch | 6 +-- ...ernel-kernel-make-kernel_t-MLS-trust.patch | 6 +-- ...ystem-setrans-allow-setrans_t-use-fd.patch | 4 +- ...ystem-systemd-make-_systemd_t-MLS-tr.patch | 6 +-- ...ystem-logging-make-syslogd_runtime_t.patch | 6 +-- .../refpolicy/refpolicy_common.inc | 15 +++--- recipes-security/refpolicy/refpolicy_git.inc | 4 +- 62 files changed, 224 insertions(+), 135 deletions(-) create mode 100644 recipes-security/refpolicy/refpolicy/0002-refpolicy-minimum-enable-nscd_use_shm.patch rename recipes-security/refpolicy/refpolicy/{0034-policy-modules-system-systemd-enable-support-for-sys.patch => 0033-policy-modules-system-systemd-enable-support-for-sys.patch} (94%) rename recipes-security/refpolicy/refpolicy/{0035-policy-modules-system-logging-allow-systemd-tmpfiles.patch => 0034-policy-modules-system-logging-allow-systemd-tmpfiles.patch} (93%) rename recipes-security/refpolicy/refpolicy/{0036-policy-modules-system-systemd-allow-systemd_logind_t.patch => 0035-policy-modules-system-systemd-allow-systemd_logind_t.patch} (89%) rename recipes-security/refpolicy/refpolicy/{0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch => 0036-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch} (91%) rename recipes-security/refpolicy/refpolicy/{0038-policy-modules-system-systemd-systemd-user-fixes.patch => 0037-policy-modules-system-systemd-systemd-user-fixes.patch} (90%) rename recipes-security/refpolicy/refpolicy/{0040-policy-modules-system-logging-grant-getpcap-capabili.patch => 0038-policy-modules-system-logging-grant-getpcap-capabili.patch} (90%) rename recipes-security/refpolicy/refpolicy/{0057-Allow-services-to-read-tmpfs-under-run-credentials.patch => 0039-policy-modules-system-allow-services-to-read-tmpfs-u.patch} (93%) create mode 100644 recipes-security/refpolicy/refpolicy/0040-policy-modules-kernel-domain-allow-all-domains-to-co.patch