##
-@@ -1396,6 +1396,10 @@ files_relabelfrom_home(systemd_tmpfiles_t)
+@@ -1640,6 +1640,10 @@ files_relabelfrom_home(systemd_tmpfiles_t)
files_relabelto_home(systemd_tmpfiles_t)
files_relabelto_etc_dirs(systemd_tmpfiles_t)
files_setattr_lock_dirs(systemd_tmpfiles_t)
@@ -60,5 +60,5 @@ index 3d9198342..31d28a0e3 100644
files_manage_etc_symlinks(systemd_tmpfiles_t)
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch b/recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
similarity index 88%
rename from recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch
rename to recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
index 49aa7a6..56b6119 100644
--- a/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-allow-systemd_logind_t.patch
+++ b/recipes-security/refpolicy/refpolicy/0036-policy-modules-system-systemd-allow-systemd_logind_t.patch
@@ -1,4 +1,4 @@
-From 4e2df7ca542b6c94e74345daaecb33efc82d749a Mon Sep 17 00:00:00 2001
+From 2acb5ddbd04c578a420418e3bcb572bbd2dfbae6 Mon Sep 17 00:00:00 2001
From: Yi Zhao
Date: Sat, 18 Dec 2021 09:26:43 +0800
Subject: [PATCH] policy/modules/system/systemd: allow systemd_logind_t to read
@@ -27,10 +27,10 @@ Signed-off-by: Yi Zhao
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 847895e63..1a83148c1 100644
+index 362248d17..4a1e06640 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
-@@ -721,6 +721,7 @@ userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
+@@ -920,6 +920,7 @@ userdom_relabelfrom_user_runtime_dirs(systemd_logind_t)
userdom_relabelto_user_runtime_dirs(systemd_logind_t)
userdom_setattr_user_ttys(systemd_logind_t)
userdom_use_user_ttys(systemd_logind_t)
@@ -39,5 +39,5 @@ index 847895e63..1a83148c1 100644
# Needed to work around patch not yet merged into the systemd-logind supported on RHEL 7.x
# The change in systemd by Nicolas Iooss on 02-Feb-2016 with hash 4b51966cf6c06250036e428608da92f8640beb96
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch b/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch
deleted file mode 100644
index 9465a3e..0000000
--- a/recipes-security/refpolicy/refpolicy/0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 07866ad826b299194c1bfd7978e5077dde72a68e Mon Sep 17 00:00:00 2001
-From: Yi Zhao
-Date: Mon, 11 Oct 2021 10:10:10 +0800
-Subject: [PATCH] policy/modules/admin/usermanage: allow useradd to relabel
- user home files
-
-Fixes:
-avc: denied { relabelfrom } for pid=491 comm="useradd" name=".bashrc"
-dev="vda" ino=12641 scontext=root:sysadm_r:useradd_t
-tcontext=user_u:object_r:user_home_t tclass=file permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao
----
- policy/modules/admin/usermanage.te | 2 ++
- policy/modules/system/userdomain.if | 18 ++++++++++++++++++
- 2 files changed, 20 insertions(+)
-
-diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
-index 98646b4b4..50c479498 100644
---- a/policy/modules/admin/usermanage.te
-+++ b/policy/modules/admin/usermanage.te
-@@ -496,6 +496,7 @@ files_read_etc_runtime_files(useradd_t)
-
- fs_search_auto_mountpoints(useradd_t)
- fs_getattr_xattr_fs(useradd_t)
-+fs_search_tmpfs(useradd_t)
-
- mls_file_upgrade(useradd_t)
-
-@@ -541,6 +542,7 @@ userdom_home_filetrans_user_home_dir(useradd_t)
- userdom_manage_user_home_content_dirs(useradd_t)
- userdom_manage_user_home_content_files(useradd_t)
- userdom_user_home_dir_filetrans_user_home_content(useradd_t, notdevfile_class_set)
-+userdom_relabel_user_home_content_files(useradd_t)
-
- optional_policy(`
- mta_manage_spool(useradd_t)
-diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
-index 22b3c1bf7..ec625170d 100644
---- a/policy/modules/system/userdomain.if
-+++ b/policy/modules/system/userdomain.if
-@@ -2362,6 +2362,24 @@ interface(`userdom_dontaudit_relabel_user_home_content_files',`
- dontaudit $1 user_home_t:file relabel_file_perms;
- ')
-
-+########################################
-+##
-+## Relabel user home files.
-+##
-+##
-+##
-+## Domain allowed access.
-+##
-+##
-+#
-+interface(`userdom_relabel_user_home_content_files',`
-+ gen_require(`
-+ type user_home_t;
-+ ')
-+
-+ allow $1 user_home_t:file relabel_file_perms;
-+')
-+
- ########################################
- ##
- ## Read user home subdirectory symbolic links.
---
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch b/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
new file mode 100644
index 0000000..78c4dc8
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch
@@ -0,0 +1,36 @@
+From 51a7f8058fee569322c1a0597fccd36c318ad943 Mon Sep 17 00:00:00 2001
+From: Yi Zhao
+Date: Fri, 28 Oct 2022 11:56:09 +0800
+Subject: [PATCH] policy/modules/roles/sysadm: allow sysadm to use init file
+ descriptors
+
+Root can not login via console without this.
+
+Fixes:
+avc: denied { use } for pid=323 comm="sh" path="/dev/tty1"
+dev="devtmpfs" ino=21 scontext=root:sysadm_r:sysadm_t
+tcontext=system_u:system_r:init_t tclass=fd permissive=0
+
+Upstream-Status: Pending
+
+Signed-off-by: Yi Zhao
+---
+ policy/modules/roles/sysadm.te | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
+index bb715a847..088c954f5 100644
+--- a/policy/modules/roles/sysadm.te
++++ b/policy/modules/roles/sysadm.te
+@@ -86,6 +86,8 @@ ifdef(`init_systemd',`
+ # LookupDynamicUserByUID on org.freedesktop.systemd1.
+ init_dbus_chat(sysadm_t)
+
++ init_use_fds(sysadm_t)
++
+ # Allow sysadm to get the status of and set properties of other users,
+ # sessions, and seats on the system.
+ systemd_dbus_chat_logind(sysadm_t)
+--
+2.25.1
+
diff --git a/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch b/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch
new file mode 100644
index 0000000..85bb82b
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-systemd-systemd-user-fixes.patch
@@ -0,0 +1,84 @@
+From 5b6f3fcb1ddabd0a66541959306e7b0adfe2b2b0 Mon Sep 17 00:00:00 2001
+From: Yi Zhao
+Date: Thu, 4 Feb 2021 10:48:54 +0800
+Subject: [PATCH] policy/modules/system/systemd: systemd --user fixes
+
+Fixes:
+systemctl[277]: Failed to connect to bus: No medium found
+
+avc: denied { mknod } for pid=297 comm="systemd" capability=27
+scontext=root:sysadm_r:sysadm_systemd_t
+tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
+
+avc: denied { bpf } for pid=297 comm="systemd" capability=39
+scontext=root:sysadm_r:sysadm_systemd_t
+tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
+
+avc: denied { sys_admin } for pid=297 comm="systemd" capability=21
+scontext=root:sysadm_r:sysadm_systemd_t
+tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
+
+avc: denied { perfmon } for pid=297 comm="systemd" capability=38
+scontext=root:sysadm_r:sysadm_systemd_t
+tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
+
+Upstream-Status: Inappropriate [embedded specific]
+
+Signed-off-by: Yi Zhao
+---
+ policy/modules/roles/sysadm.te | 2 ++
+ policy/modules/system/systemd.if | 21 ++++++++++++++++++++-
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
+index 088c954f5..92f50fd5a 100644
+--- a/policy/modules/roles/sysadm.te
++++ b/policy/modules/roles/sysadm.te
+@@ -98,6 +98,8 @@ ifdef(`init_systemd',`
+
+ # Allow sysadm to follow logs in the journal, i.e. with podman logs -f
+ systemd_watch_journal_dirs(sysadm_t)
++
++ systemd_sysadm_user(sysadm_t)
+ ')
+
+ tunable_policy(`allow_ptrace',`
+diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
+index 9dc91fbb7..325ca548b 100644
+--- a/policy/modules/system/systemd.if
++++ b/policy/modules/system/systemd.if
+@@ -58,7 +58,7 @@ template(`systemd_role_template',`
+ allow $1_systemd_t self:process { getsched signal };
+ allow $1_systemd_t self:netlink_kobject_uevent_socket create_socket_perms;
+ allow $1_systemd_t self:unix_stream_socket create_stream_socket_perms;
+- allow $1_systemd_t $3:process { setsched rlimitinh signal_perms };
++ allow $1_systemd_t $3:process { setsched rlimitinh signal_perms noatsecure };
+ corecmd_shell_domtrans($1_systemd_t, $3)
+ corecmd_bin_domtrans($1_systemd_t, $3)
+
+@@ -2613,3 +2613,22 @@ interface(`systemd_use_inherited_machined_ptys', `
+ allow $1 systemd_machined_t:fd use;
+ allow $1 systemd_machined_devpts_t:chr_file rw_inherited_term_perms;
+ ')
++
++#########################################
++##
++## sysadm user for systemd --user
++##
++##
++##
++## Role allowed access.
++##
++##
++#
++interface(`systemd_sysadm_user',`
++ gen_require(`
++ type sysadm_systemd_t;
++ ')
++
++ allow sysadm_systemd_t self:capability { mknod sys_admin };
++ allow sysadm_systemd_t self:capability2 { bpf perfmon };
++')
+--
+2.25.1
+
diff --git a/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
similarity index 84%
rename from recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
rename to recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
index 4cae8c6..c3b4b55 100644
--- a/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
+++ b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch
@@ -1,4 +1,4 @@
-From 705008ba8ef960cf2e4813b4b8c5a87b919d545f Mon Sep 17 00:00:00 2001
+From ccdd22cc2776b695f96faffc88699aa2b182e085 Mon Sep 17 00:00:00 2001
From: Wenzong Fan
Date: Sat, 15 Feb 2014 04:22:47 -0500
Subject: [PATCH] policy/modules/system/mount: make mount_t domain MLS trusted
@@ -19,10 +19,10 @@ Signed-off-by: Yi Zhao
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
-index e39ab41a8..3481f9294 100644
+index d028723ce..97f49e58e 100644
--- a/policy/modules/system/mount.te
+++ b/policy/modules/system/mount.te
-@@ -116,6 +116,7 @@ fs_dontaudit_write_all_image_files(mount_t)
+@@ -112,6 +112,7 @@ fs_dontaudit_write_all_image_files(mount_t)
mls_file_read_all_levels(mount_t)
mls_file_write_all_levels(mount_t)
@@ -31,5 +31,5 @@ index e39ab41a8..3481f9294 100644
selinux_get_enforce_mode(mount_t)
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch b/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch
deleted file mode 100644
index ea8af31..0000000
--- a/recipes-security/refpolicy/refpolicy/0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 99139408a7919282e97e1b2fcd5da33248386d73 Mon Sep 17 00:00:00 2001
-From: Yi Zhao
-Date: Mon, 25 Jan 2021 14:14:59 +0800
-Subject: [PATCH] policy/modules/system/systemd: fix systemd-resolved startup
- failures
-
-* Allow systemd_resolved_t to manage systemd_resolved_runtime_t link
- files
-* Allow systemd_resolved_t to send and recevie messages from dhcpc over
- dbus
-
-Fixes:
-avc: denied { create } for pid=329 comm="systemd-resolve"
-name=".#stub-resolv.conf53cb7f9d1e3aa72b"
-scontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
-tcontext=system_u:object_r:systemd_resolved_runtime_t:s0 tclass=lnk_file
-permissive=0
-
-avc: denied { send_msg } for msgtype=method_call
-interface=org.freedesktop.resolve1.Manager member=RevertLink
-dest=org.freedesktop.resolve1 spid=340 tpid=345
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
-tclass=dbus permissive=0
-
-avc: denied { send_msg } for msgtype=method_return dest=:1.6 spid=345
-tpid=340 scontext=system_u:system_r:systemd_resolved_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=dbus
-permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao
----
- policy/modules/system/systemd.te | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 31d28a0e3..448905ff7 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -1199,6 +1199,7 @@ allow systemd_resolved_t systemd_networkd_runtime_t:dir watch;
-
- manage_dirs_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
- manage_files_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
-+manage_lnk_files_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
- manage_sock_files_pattern(systemd_resolved_t, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
- init_runtime_filetrans(systemd_resolved_t, systemd_resolved_runtime_t, dir)
-
-@@ -1236,6 +1237,7 @@ optional_policy(`
- dbus_system_bus_client(systemd_resolved_t)
- dbus_watch_system_bus_runtime_dirs(systemd_resolved_t)
- dbus_watch_system_bus_runtime_named_sockets(systemd_resolved_t)
-+ sysnet_dbus_chat_dhcpc(systemd_resolved_t)
- ')
-
- #########################################
---
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
similarity index 83%
rename from recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
rename to recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
index 86317b3..d711612 100644
--- a/recipes-security/refpolicy/refpolicy/0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
+++ b/recipes-security/refpolicy/refpolicy/0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch
@@ -1,4 +1,4 @@
-From ef2b9196f3a51745a3644489d316bda7cd67f72d Mon Sep 17 00:00:00 2001
+From 64498d6cd30a0a65a24e3e7ab22cca5921c2db89 Mon Sep 17 00:00:00 2001
From: Xin Ouyang
Date: Mon, 28 Jan 2019 14:05:18 +0800
Subject: [PATCH] policy/modules/roles/sysadm: MLS - sysadm rw to clearance
@@ -7,7 +7,7 @@ The two new rules make sysadm_t domain MLS trusted for:
- reading from files at all levels.
- writing to processes up to its clearance(s0-s15).
-With default MLS policy, root user would login in as sysadm_t:s0 by
+With default MLS policy, root user would login as sysadm_t:s0 by
default. Most processes will run in sysadm_t:s0 because no
domtrans/rangetrans rules, as a result, even root could not access
high level files/processes.
@@ -23,10 +23,10 @@ Signed-off-by: Yi Zhao
1 file changed, 2 insertions(+)
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
-index e1933a5bd..0682ed31a 100644
+index 92f50fd5a..8c154d474 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
-@@ -44,6 +44,8 @@ logging_watch_all_logs(sysadm_t)
+@@ -45,6 +45,8 @@ logging_watch_all_logs(sysadm_t)
logging_watch_audit_log(sysadm_t)
mls_process_read_all_levels(sysadm_t)
@@ -36,5 +36,5 @@ index e1933a5bd..0682ed31a 100644
selinux_read_policy(sysadm_t)
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch b/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch
deleted file mode 100644
index 91588f1..0000000
--- a/recipes-security/refpolicy/refpolicy/0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch
+++ /dev/null
@@ -1,156 +0,0 @@
-From 81e63f86d6d030eaf0204796e32011c08e7b5e52 Mon Sep 17 00:00:00 2001
-From: Yi Zhao
-Date: Tue, 28 Sep 2021 10:03:04 +0800
-Subject: [PATCH] policy/modules/system/systemd: allow systemd_*_t to get the
- attributes of tmpfs and cgroups
-
-Fixes:
-avc: denied { getattr } for pid=245 comm="systemd-network" name="/"
-dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_networkd_t
-tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
-
-avc: denied { getattr } for pid=252 comm="systemd-resolve" name="/"
-dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_resolved_t
-tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
-
-avc: denied { getattr } for pid=260 comm="systemd-user-se" name="/"
-dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_sessions_t
-tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
-
-avc: denied { search } for pid=293 comm="systemd-user-ru" name="/"
-dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_user_runtime_dir_t
-tcontext=system_u:object_r:cgroup_t tclass=dir permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao
----
- policy/modules/system/systemd.te | 35 ++++++++++++++++++++++++++++++++
- 1 file changed, 35 insertions(+)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 448905ff7..847895e63 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -337,6 +337,10 @@ udev_read_runtime_files(systemd_backlight_t)
-
- files_search_var_lib(systemd_backlight_t)
-
-+fs_getattr_tmpfs(systemd_backlight_t)
-+fs_search_cgroup_dirs(systemd_backlight_t)
-+fs_getattr_cgroup(systemd_backlight_t)
-+
- #######################################
- #
- # Binfmt local policy
-@@ -447,6 +451,7 @@ files_list_usr(systemd_generator_t)
- fs_list_efivars(systemd_generator_t)
- fs_getattr_cgroup(systemd_generator_t)
- fs_getattr_xattr_fs(systemd_generator_t)
-+fs_getattr_tmpfs(systemd_generator_t)
-
- init_create_runtime_files(systemd_generator_t)
- init_manage_runtime_dirs(systemd_generator_t)
-@@ -515,6 +520,10 @@ systemd_log_parse_environment(systemd_hostnamed_t)
- # Allow reading /run/udev/data/+dmi:id
- udev_read_runtime_files(systemd_hostnamed_t)
-
-+fs_getattr_tmpfs(systemd_hostnamed_t)
-+fs_search_cgroup_dirs(systemd_hostnamed_t)
-+fs_getattr_cgroup(systemd_hostnamed_t)
-+
- optional_policy(`
- dbus_connect_system_bus(systemd_hostnamed_t)
- dbus_system_bus_client(systemd_hostnamed_t)
-@@ -835,6 +844,10 @@ dev_read_sysfs(systemd_modules_load_t)
- files_mmap_read_kernel_modules(systemd_modules_load_t)
- files_read_etc_files(systemd_modules_load_t)
-
-+fs_getattr_tmpfs(systemd_modules_load_t)
-+fs_search_cgroup_dirs(systemd_modules_load_t)
-+fs_getattr_cgroup(systemd_modules_load_t)
-+
- modutils_read_module_config(systemd_modules_load_t)
- modutils_read_module_deps(systemd_modules_load_t)
-
-@@ -885,6 +898,7 @@ files_watch_runtime_dirs(systemd_networkd_t)
- files_watch_root_dirs(systemd_networkd_t)
- files_list_runtime(systemd_networkd_t)
- fs_getattr_xattr_fs(systemd_networkd_t)
-+fs_getattr_tmpfs(systemd_networkd_t)
- fs_getattr_cgroup(systemd_networkd_t)
- fs_search_cgroup_dirs(systemd_networkd_t)
- fs_read_nsfs_files(systemd_networkd_t)
-@@ -1185,6 +1199,10 @@ udev_read_runtime_files(systemd_rfkill_t)
-
- systemd_log_parse_environment(systemd_rfkill_t)
-
-+fs_getattr_tmpfs(systemd_rfkill_t)
-+fs_search_cgroup_dirs(systemd_rfkill_t)
-+fs_getattr_cgroup(systemd_rfkill_t)
-+
- #########################################
- #
- # Resolved local policy
-@@ -1224,6 +1242,9 @@ auth_use_nsswitch(systemd_resolved_t)
- files_watch_root_dirs(systemd_resolved_t)
- files_watch_runtime_dirs(systemd_resolved_t)
- files_list_runtime(systemd_resolved_t)
-+fs_getattr_tmpfs(systemd_resolved_t)
-+fs_search_cgroup_dirs(systemd_resolved_t)
-+fs_getattr_cgroup(systemd_resolved_t)
-
- init_dgram_send(systemd_resolved_t)
-
-@@ -1288,6 +1309,10 @@ seutil_read_file_contexts(systemd_sessions_t)
-
- systemd_log_parse_environment(systemd_sessions_t)
-
-+fs_getattr_tmpfs(systemd_sessions_t)
-+fs_search_cgroup_dirs(systemd_sessions_t)
-+fs_getattr_cgroup(systemd_sessions_t)
-+
- ########################################
- #
- # sysctl local policy
-@@ -1304,6 +1329,9 @@ kernel_rw_all_sysctls(systemd_sysctl_t)
- kernel_dontaudit_getattr_proc(systemd_sysctl_t)
-
- files_read_etc_files(systemd_sysctl_t)
-+fs_getattr_tmpfs(systemd_sysctl_t)
-+fs_search_cgroup_dirs(systemd_sysctl_t)
-+fs_getattr_cgroup(systemd_sysctl_t)
-
- systemd_log_parse_environment(systemd_sysctl_t)
-
-@@ -1409,6 +1437,8 @@ fs_getattr_tmpfs(systemd_tmpfiles_t)
- fs_getattr_xattr_fs(systemd_tmpfiles_t)
- fs_list_tmpfs(systemd_tmpfiles_t)
- fs_relabelfrom_tmpfs_dirs(systemd_tmpfiles_t)
-+fs_search_cgroup_dirs(systemd_tmpfiles_t)
-+fs_getattr_cgroup(systemd_tmpfiles_t)
-
- selinux_get_fs_mount(systemd_tmpfiles_t)
- selinux_use_status_page(systemd_tmpfiles_t)
-@@ -1497,6 +1527,10 @@ allow systemd_update_done_t systemd_update_run_t:file manage_file_perms;
- files_etc_filetrans(systemd_update_done_t, systemd_update_run_t, file)
- files_var_filetrans(systemd_update_done_t, systemd_update_run_t, file)
-
-+fs_getattr_tmpfs(systemd_update_done_t)
-+fs_search_cgroup_dirs(systemd_update_done_t)
-+fs_getattr_cgroup(systemd_update_done_t)
-+
- kernel_read_kernel_sysctls(systemd_update_done_t)
-
- selinux_use_status_page(systemd_update_done_t)
-@@ -1601,6 +1635,7 @@ fs_unmount_tmpfs(systemd_user_runtime_dir_t)
- fs_relabelfrom_tmpfs_dirs(systemd_user_runtime_dir_t)
- fs_read_cgroup_files(systemd_user_runtime_dir_t)
- fs_getattr_cgroup(systemd_user_runtime_dir_t)
-+fs_search_cgroup_dirs(systemd_user_runtime_dir_t)
-
- kernel_read_kernel_sysctls(systemd_user_runtime_dir_t)
- kernel_dontaudit_getattr_proc(systemd_user_runtime_dir_t)
---
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch b/recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
similarity index 84%
rename from recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
rename to recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
index f659e7e..d22dacf 100644
--- a/recipes-security/refpolicy/refpolicy/0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
+++ b/recipes-security/refpolicy/refpolicy/0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch
@@ -1,4 +1,4 @@
-From 18ad027229a06fdcb833482dff0c2ae637d08e78 Mon Sep 17 00:00:00 2001
+From e82c43e60ef52ba00e8f2af5b46b2a6d49331209 Mon Sep 17 00:00:00 2001
From: Xin Ouyang
Date: Fri, 23 Aug 2013 12:01:53 +0800
Subject: [PATCH] policy/modules/services/rpc: make nfsd_t domain MLS trusted
@@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao
2 files changed, 7 insertions(+)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index ca951cb44..a32c59eb1 100644
+index 5124ae016..a40db8507 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
-@@ -356,6 +356,8 @@ mls_process_read_all_levels(kernel_t)
+@@ -368,6 +368,8 @@ mls_process_read_all_levels(kernel_t)
mls_process_write_all_levels(kernel_t)
mls_file_write_all_levels(kernel_t)
mls_file_read_all_levels(kernel_t)
@@ -28,7 +28,7 @@ index ca951cb44..a32c59eb1 100644
ifdef(`distro_redhat',`
# Bugzilla 222337
diff --git a/policy/modules/services/rpcbind.te b/policy/modules/services/rpcbind.te
-index e1eb7d5fc..da0994749 100644
+index 2a712192b..923e48db7 100644
--- a/policy/modules/services/rpcbind.te
+++ b/policy/modules/services/rpcbind.te
@@ -73,6 +73,11 @@ logging_send_syslog_msg(rpcbind_t)
@@ -36,7 +36,7 @@ index e1eb7d5fc..da0994749 100644
miscfiles_read_localization(rpcbind_t)
+# nfsd_t would not be allowed to send unix_stream_socket to rpcbind_t,
-+# because the are running in different level. So add rules to allow this.
++# because they are running in different level. So add rules to allow this.
+mls_socket_read_all_levels(rpcbind_t)
+mls_socket_write_all_levels(rpcbind_t)
+
@@ -44,5 +44,5 @@ index e1eb7d5fc..da0994749 100644
term_dontaudit_use_unallocated_ttys(rpcbind_t)
')
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch b/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch
deleted file mode 100644
index 2232d48..0000000
--- a/recipes-security/refpolicy/refpolicy/0041-policy-modules-system-logging-fix-syslogd-failures-f.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From dc2c9c91219311f6c4d985169dff6c5931a465d7 Mon Sep 17 00:00:00 2001
-From: Wenzong Fan
-Date: Thu, 4 Feb 2016 02:10:15 -0500
-Subject: [PATCH] policy/modules/system/logging: fix syslogd failures for
- systemd
-
-Fixes:
-syslogd[243]: Error opening log file: /var/log/auth.log: Permission denied
-syslogd[243]: Error opening log file: /var/log/syslog: Permission denied
-syslogd[243]: Error opening log file: /var/log/kern.log: Permission denied
-syslogd[243]: Error opening log file: /var/log/mail.log: Permission denied
-syslogd[243]: Error opening log file: /var/log/mail.err: Permission denied
-syslogd[243]: Error opening log file: /var/log/messages: Permission denied
-
-avc: denied { search } for pid=243 comm="syslogd" name="/"
-dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t
-tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=0
-
-avc: denied { write } for pid=162 comm="systemd-journal"
-name="syslog" dev="tmpfs" ino=515 scontext=system_u:system_r:syslogd_t
-tcontext=system_u:object_r:syslogd_runtime_t tclass=sock_file
-permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Wenzong Fan
-Signed-off-by: Yi Zhao
----
- policy/modules/system/logging.te | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index cc530a2be..5b4b5ec5d 100644
---- a/policy/modules/system/logging.te
-+++ b/policy/modules/system/logging.te
-@@ -431,7 +431,7 @@ files_search_var_lib(syslogd_t)
-
- # manage runtime files
- allow syslogd_t syslogd_runtime_t:dir create_dir_perms;
--allow syslogd_t syslogd_runtime_t:sock_file { create setattr unlink };
-+allow syslogd_t syslogd_runtime_t:sock_file { create setattr unlink write };
- allow syslogd_t syslogd_runtime_t:file map;
- manage_files_pattern(syslogd_t, syslogd_runtime_t, syslogd_runtime_t)
- files_runtime_filetrans(syslogd_t, syslogd_runtime_t, file)
-@@ -495,6 +495,7 @@ files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir })
-
- fs_getattr_all_fs(syslogd_t)
- fs_search_auto_mountpoints(syslogd_t)
-+fs_search_tmpfs(syslogd_t)
-
- mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
-
---
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch b/recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
similarity index 90%
rename from recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
rename to recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
index ace056a..30c84f6 100644
--- a/recipes-security/refpolicy/refpolicy/0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
+++ b/recipes-security/refpolicy/refpolicy/0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch
@@ -1,4 +1,4 @@
-From b41a910654f5c5fe198b1695df18b6f6a1af7904 Mon Sep 17 00:00:00 2001
+From 9343914c0486b5aa6ff7cceeb8f6c399115e5fb3 Mon Sep 17 00:00:00 2001
From: Yi Zhao
Date: Tue, 30 Jun 2020 10:18:20 +0800
Subject: [PATCH] policy/modules/admin/dmesg: make dmesg_t MLS trusted reading
@@ -19,7 +19,7 @@ Signed-off-by: Yi Zhao
1 file changed, 2 insertions(+)
diff --git a/policy/modules/admin/dmesg.te b/policy/modules/admin/dmesg.te
-index f3421fdbb..d87ee5583 100644
+index f1da315a9..89478c38e 100644
--- a/policy/modules/admin/dmesg.te
+++ b/policy/modules/admin/dmesg.te
@@ -52,6 +52,8 @@ miscfiles_read_localization(dmesg_t)
@@ -32,5 +32,5 @@ index f3421fdbb..d87ee5583 100644
seutil_sigchld_newrole(dmesg_t)
')
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch b/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch
deleted file mode 100644
index 108f62f..0000000
--- a/recipes-security/refpolicy/refpolicy/0042-policy-modules-system-systemd-systemd-user-fixes.patch
+++ /dev/null
@@ -1,172 +0,0 @@
-From 20b2608718064a92f9255adb459a97d95fdbc22e Mon Sep 17 00:00:00 2001
-From: Yi Zhao
-Date: Thu, 4 Feb 2021 10:48:54 +0800
-Subject: [PATCH] policy/modules/system/systemd: systemd --user fixes
-
-Fixes:
-systemctl[1598]: Failed to connect to bus: $DBUS_SESSION_BUS_ADDRESS and
-$XDG_RUNTIME_DIR not defined (consider using --machine=@.host
---user to connect to bus of other user)
-
-avc: denied { connectto } for pid=293 comm="login"
-path="/run/systemd/userdb/io.systemd.Multiplexer"
-scontext=system_u:system_r:local_login_t
-tcontext=system_u:system_r:initrc_t tclass=unix_stream_socket
-permissive=0
-
-avc: denied { read } for pid=293 comm="login" name="io.systemd.DropIn"
-dev="tmpfs" ino=44 scontext=system_u:system_r:local_login_t
-tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
-permissive=0
-
-avc: denied { read } for pid=293 comm="login"
-name="io.systemd.NameServiceSwitch" dev="tmpfs" ino=43
-scontext=system_u:system_r:local_login_t
-tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
-permissive=0
-
-avc: denied { connectto } for pid=244 comm="systemd-logind"
-path="/run/systemd/userdb/io.systemd.Multiplexer"
-scontext=system_u:system_r:systemd_logind_t
-tcontext=system_u:system_r:initrc_t tclass=unix_stream_socket
-permissive=0
-
-avc: denied { read } for pid=244 comm="systemd-logind"
-name="io.systemd.DropIn" dev="tmpfs" ino=44
-scontext=system_u:system_r:systemd_logind_t
-tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
-permissive=0
-
-avc: denied { read } for pid=244 comm="systemd-logind"
-name="io.systemd.NameServiceSwitch" dev="tmpfs" ino=43
-scontext=system_u:system_r:systemd_logind_t
-tcontext=system_u:object_r:systemd_userdb_runtime_t tclass=lnk_file
-permissive=0
-
-avc: denied { mknod } for pid=297 comm="systemd" capability=27
-scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
-
-avc: denied { setrlimit } for pid=297 comm="systemd"
-scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=root:sysadm_r:sysadm_systemd_t tclass=process permissive=0
-
-avc: denied { bpf } for pid=297 comm="systemd" capability=39
-scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
-
-avc: denied { sys_admin } for pid=297 comm="systemd" capability=21
-scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability permissive=0
-
-avc: denied { perfmon } for pid=297 comm="systemd" capability=38
-scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=root:sysadm_r:sysadm_systemd_t tclass=capability2 permissive=0
-
-avc: denied { watch } for pid=297 comm="systemd" path="/etc" dev="vda"
-ino=173 scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=system_u:object_r:etc_t tclass=dir permissive=0
-
-avc: denied { getattr } for pid=297 comm="systemd" name="/" dev="vda"
-ino=2 scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=system_u:object_r:fs_t tclass=filesystem permissive=0
-
-avc: denied { read } for pid=297 comm="systemd" name="unix" dev="proc"
-ino=4026532057 scontext=root:sysadm_r:sysadm_systemd_t
-tcontext=system_u:object_r:proc_net_t tclass=file permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao
----
- policy/modules/roles/sysadm.te | 2 ++
- policy/modules/system/init.if | 1 +
- policy/modules/system/systemd.if | 27 ++++++++++++++++++++++++++-
- 3 files changed, 29 insertions(+), 1 deletion(-)
-
-diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
-index 46d3e2f0b..e1933a5bd 100644
---- a/policy/modules/roles/sysadm.te
-+++ b/policy/modules/roles/sysadm.te
-@@ -92,6 +92,8 @@ ifdef(`init_systemd',`
- # Allow sysadm to query and set networking settings on the system.
- systemd_dbus_chat_networkd(sysadm_t)
- fs_read_nsfs_files(sysadm_t)
-+
-+ systemd_sysadm_user(sysadm_t)
- ')
-
- tunable_policy(`allow_ptrace',`
-diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
-index 0171ee299..8ca29f654 100644
---- a/policy/modules/system/init.if
-+++ b/policy/modules/system/init.if
-@@ -959,6 +959,7 @@ interface(`init_unix_stream_socket_connectto',`
- ')
-
- allow $1 init_t:unix_stream_socket connectto;
-+ allow $1 initrc_t:unix_stream_socket connectto;
- ')
-
- ########################################
-diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
-index 38adf050c..5c44d8d8a 100644
---- a/policy/modules/system/systemd.if
-+++ b/policy/modules/system/systemd.if
-@@ -57,7 +57,7 @@ template(`systemd_role_template',`
- allow $1_systemd_t self:process { getsched signal };
- allow $1_systemd_t self:netlink_kobject_uevent_socket create_socket_perms;
- allow $1_systemd_t self:unix_stream_socket create_stream_socket_perms;
-- allow $1_systemd_t $3:process { setsched rlimitinh signal_perms };
-+ allow $1_systemd_t $3:process { setsched rlimitinh signal_perms noatsecure };
- corecmd_shell_domtrans($1_systemd_t, $3)
- corecmd_bin_domtrans($1_systemd_t, $3)
-
-@@ -88,8 +88,11 @@ template(`systemd_role_template',`
-
- fs_manage_cgroup_files($1_systemd_t)
- fs_watch_cgroup_files($1_systemd_t)
-+ files_watch_etc_dirs($1_systemd_t)
-+ fs_getattr_xattr_fs($1_systemd_t)
-
- kernel_dontaudit_getattr_proc($1_systemd_t)
-+ kernel_read_network_state($1_systemd_t)
-
- selinux_use_status_page($1_systemd_t)
-
-@@ -1052,6 +1055,7 @@ interface(`systemd_stream_connect_userdb', `
- init_search_runtime($1)
- allow $1 systemd_userdb_runtime_t:dir list_dir_perms;
- allow $1 systemd_userdb_runtime_t:sock_file write_sock_file_perms;
-+ allow $1 systemd_userdb_runtime_t:lnk_file read_lnk_file_perms;
- init_unix_stream_socket_connectto($1)
- ')
-
-@@ -2003,3 +2007,24 @@ interface(`systemd_use_inherited_machined_ptys', `
- allow $1 systemd_machined_t:fd use;
- allow $1 systemd_machined_devpts_t:chr_file rw_inherited_term_perms;
- ')
-+
-+#########################################
-+##
-+## sysadm user for systemd --user
-+##
-+##
-+##
-+## Role allowed access.
-+##
-+##
-+#
-+interface(`systemd_sysadm_user',`
-+ gen_require(`
-+ type sysadm_systemd_t;
-+ ')
-+
-+ allow sysadm_systemd_t self:capability { mknod sys_admin };
-+ allow sysadm_systemd_t self:capability2 { bpf perfmon };
-+ allow sysadm_systemd_t self:process setrlimit;
-+ allow $1 sysadm_systemd_t:system reload;
-+')
---
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch b/recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
similarity index 94%
rename from recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
rename to recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
index 8b9f98c..932047a 100644
--- a/recipes-security/refpolicy/refpolicy/0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
+++ b/recipes-security/refpolicy/refpolicy/0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
@@ -1,4 +1,4 @@
-From c2e99e27acc1454d792b3e8d6f24d3a2a3be29e3 Mon Sep 17 00:00:00 2001
+From 057e4e6a6e2e87edcd6a93dd533620700b00b1c2 Mon Sep 17 00:00:00 2001
From: Wenzong Fan
Date: Fri, 13 Oct 2017 07:20:40 +0000
Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS trusted for
@@ -59,10 +59,10 @@ Signed-off-by: Yi Zhao
1 file changed, 2 insertions(+)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index a32c59eb1..1c53754ee 100644
+index a40db8507..40cd52825 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
-@@ -358,6 +358,8 @@ mls_file_write_all_levels(kernel_t)
+@@ -370,6 +370,8 @@ mls_file_write_all_levels(kernel_t)
mls_file_read_all_levels(kernel_t)
mls_socket_write_all_levels(kernel_t)
mls_fd_use_all_levels(kernel_t)
@@ -72,5 +72,5 @@ index a32c59eb1..1c53754ee 100644
ifdef(`distro_redhat',`
# Bugzilla 222337
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch b/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch
deleted file mode 100644
index 504e028..0000000
--- a/recipes-security/refpolicy/refpolicy/0043-policy-modules-system-sysnetwork-support-priviledge-.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From d1c159d4400722e783d12cc3684c1cf15004f7a9 Mon Sep 17 00:00:00 2001
-From: Yi Zhao
-Date: Thu, 24 Sep 2020 14:05:52 +0800
-Subject: [PATCH] policy/modules/system/sysnetwork: support priviledge
- separation for dhcpcd
-
-Fixes:
-
-avc: denied { sys_chroot } for pid=332 comm="dhcpcd" capability=18
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
-permissive=0
-
-avc: denied { setgid } for pid=332 comm="dhcpcd" capability=6
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
-permissive=0
-
-avc: denied { setuid } for pid=332 comm="dhcpcd" capability=7
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
-permissive=0
-
-avc: denied { setrlimit } for pid=332 comm="dhcpcd"
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=process
-permissive=0
-
-avc: denied { create } for pid=330 comm="dhcpcd"
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tclass=netlink_kobject_uevent_socket permissive=0
-
-avc: denied { setopt } for pid=330 comm="dhcpcd"
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tclass=netlink_kobject_uevent_socket permissive=0
-
-avc: denied { bind } for pid=330 comm="dhcpcd"
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tclass=netlink_kobject_uevent_socket permissive=0
-
-avc: denied { getattr } for pid=330 comm="dhcpcd"
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tclass=netlink_kobject_uevent_socket permissive=0
-
-avc: denied { read } for pid=330 comm="dhcpcd" name="n1" dev="tmpfs"
-ino=15616 scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
-
-avc: denied { open } for pid=330 comm="dhcpcd"
-path="/run/udev/data/n1" dev="tmpfs" ino=15616
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
-
-avc: denied { getattr } for pid=330 comm="dhcpcd"
-path="/run/udev/data/n1" dev="tmpfs" ino=15616
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:object_r:udev_runtime_t:s0 tclass=file permissive=0
-
-avc: denied { connectto } for pid=1600 comm="dhcpcd"
-path="/run/dhcpcd/unpriv.sock"
-scontext=root:sysadm_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tclass=unix_stream_socket permissive=0
-
-avc: denied { kill } for pid=314 comm="dhcpcd" capability=5
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023 tclass=capability
-permissive=0
-
-avc: denied { getattr } for pid=300 comm="dhcpcd"
-path="net:[4026532008]" dev="nsfs" ino=4026532008
-scontext=system_u:system_r:dhcpc_t:s0-s15:c0.c1023
-tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao
----
- policy/modules/system/sysnetwork.te | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
-index 4c317cc4c..05a9a52b8 100644
---- a/policy/modules/system/sysnetwork.te
-+++ b/policy/modules/system/sysnetwork.te
-@@ -58,10 +58,11 @@ ifdef(`distro_debian',`
- # DHCP client local policy
- #
- allow dhcpc_t self:capability { dac_override fsetid net_admin net_bind_service net_raw setpcap sys_nice sys_resource sys_tty_config };
-+allow dhcpc_t self:capability { setgid setuid sys_chroot kill };
- dontaudit dhcpc_t self:capability { sys_ptrace sys_tty_config };
- # for access("/etc/bashrc", X_OK) on Red Hat
- dontaudit dhcpc_t self:capability { dac_read_search sys_module };
--allow dhcpc_t self:process { getsched getcap setcap setfscreate ptrace signal_perms };
-+allow dhcpc_t self:process { getsched getcap setcap setfscreate ptrace signal_perms setrlimit };
-
- allow dhcpc_t self:fifo_file rw_fifo_file_perms;
- allow dhcpc_t self:tcp_socket create_stream_socket_perms;
-@@ -69,8 +70,10 @@ allow dhcpc_t self:udp_socket create_socket_perms;
- allow dhcpc_t self:packet_socket create_socket_perms;
- allow dhcpc_t self:netlink_generic_socket create_socket_perms;
- allow dhcpc_t self:netlink_route_socket create_netlink_socket_perms;
-+allow dhcpc_t self:netlink_kobject_uevent_socket create_socket_perms;
- allow dhcpc_t self:rawip_socket create_socket_perms;
- allow dhcpc_t self:unix_dgram_socket { create_socket_perms sendto };
-+allow dhcpc_t self:unix_stream_socket connectto;
-
- allow dhcpc_t dhcp_etc_t:dir list_dir_perms;
- read_lnk_files_pattern(dhcpc_t, dhcp_etc_t, dhcp_etc_t)
-@@ -146,6 +149,7 @@ files_manage_var_files(dhcpc_t)
- fs_getattr_all_fs(dhcpc_t)
- fs_search_auto_mountpoints(dhcpc_t)
- fs_search_cgroup_dirs(dhcpc_t)
-+fs_read_nsfs_files(dhcpc_t)
-
- term_dontaudit_use_all_ttys(dhcpc_t)
- term_dontaudit_use_all_ptys(dhcpc_t)
-@@ -181,6 +185,7 @@ ifdef(`init_systemd',`
- init_stream_connect(dhcpc_t)
- init_get_all_units_status(dhcpc_t)
- init_search_units(dhcpc_t)
-+ udev_read_runtime_files(dhcpc_t)
- ')
-
- optional_policy(`
---
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
similarity index 89%
rename from recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
rename to recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
index b4da47d..9e52b7f 100644
--- a/recipes-security/refpolicy/refpolicy/0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
+++ b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
@@ -1,4 +1,4 @@
-From 7bcc117ea39532427df297299c10ca1d2948a70c Mon Sep 17 00:00:00 2001
+From c47e288e8950e7e92e3c90972ca7ef8ef9fc6a7f Mon Sep 17 00:00:00 2001
From: Wenzong Fan
Date: Fri, 15 Jan 2016 03:47:05 -0500
Subject: [PATCH] policy/modules/system/init: make init_t MLS trusted for
@@ -27,10 +27,10 @@ Signed-off-by: Yi Zhao
1 file changed, 4 insertions(+)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 932d1f7b3..36becaa6e 100644
+index 97a75cf86..fee846cb5 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
-@@ -219,6 +219,10 @@ mls_process_write_all_levels(init_t)
+@@ -229,6 +229,10 @@ mls_process_write_all_levels(init_t)
mls_fd_use_all_levels(init_t)
mls_process_set_level(init_t)
@@ -42,5 +42,5 @@ index 932d1f7b3..36becaa6e 100644
# otherwise the call fails and sysvinit tries to load the policy
# again when using the initramfs
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch b/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch
deleted file mode 100644
index 2f94974..0000000
--- a/recipes-security/refpolicy/refpolicy/0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 8343ff97a265836ba1e1e2f4159f888c21e5cabe Mon Sep 17 00:00:00 2001
-From: Yi Zhao
-Date: Tue, 9 Feb 2021 17:31:55 +0800
-Subject: [PATCH] policy/modules/system/modutils: allow kmod_t to write keys
-
-Fixes:
-kernel: cfg80211: Problem loading in-kernel X.509 certificate (-13)
-
-avc: denied { write } for pid=219 comm="modprobe"
-scontext=system_u:system_r:kmod_t tcontext=system_u:system_r:kmod_t
-tclass=key permissive=0
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao
----
- policy/modules/system/modutils.te | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
-index 5b4f0aca1..008f286a8 100644
---- a/policy/modules/system/modutils.te
-+++ b/policy/modules/system/modutils.te
-@@ -42,6 +42,7 @@ allow kmod_t self:udp_socket create_socket_perms;
- allow kmod_t self:rawip_socket create_socket_perms;
-
- allow kmod_t self:lockdown confidentiality;
-+allow kmod_t self:key write;
-
- # Read module config and dependency information
- list_dirs_pattern(kmod_t, modules_conf_t, modules_conf_t)
---
-2.17.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch b/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
similarity index 92%
rename from recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
rename to recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
index 4b768e0..1bfbb16 100644
--- a/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
+++ b/recipes-security/refpolicy/refpolicy/0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch
@@ -1,4 +1,4 @@
-From d965e6a02854a07c4783cf33e95bf3c7cf9f56f1 Mon Sep 17 00:00:00 2001
+From afd35f6c73551c674e5bfe7cc1832b6a0ea717a6 Mon Sep 17 00:00:00 2001
From: Wenzong Fan
Date: Thu, 4 Feb 2016 06:03:19 -0500
Subject: [PATCH] policy/modules/system/systemd: make systemd-tmpfiles_t domain
@@ -43,10 +43,10 @@ Signed-off-by: Yi Zhao
1 file changed, 5 insertions(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 1a83148c1..736107fad 100644
+index 4a1e06640..b44b9b2d7 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
-@@ -1483,6 +1483,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
+@@ -1694,6 +1694,11 @@ sysnet_relabel_config(systemd_tmpfiles_t)
systemd_log_parse_environment(systemd_tmpfiles_t)
@@ -59,5 +59,5 @@ index 1a83148c1..736107fad 100644
userdom_relabel_user_runtime_root_dirs(systemd_tmpfiles_t)
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch b/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch
similarity index 82%
rename from recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch
rename to recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch
index 60f7dae..800439c 100644
--- a/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-systemd-make-systemd_-.patch
+++ b/recipes-security/refpolicy/refpolicy/0046-policy-modules-system-systemd-systemd-make-systemd_-.patch
@@ -1,4 +1,4 @@
-From 71986d0c6775408a1c89415dd5d4e7ea03302248 Mon Sep 17 00:00:00 2001
+From 8aa70c13d63e093bff87ea938d35dcc76e5bdd56 Mon Sep 17 00:00:00 2001
From: Yi Zhao
Date: Thu, 18 Jun 2020 09:59:58 +0800
Subject: [PATCH] policy/modules/system/systemd: systemd-*: make systemd_*_t
@@ -43,12 +43,12 @@ Signed-off-by: Yi Zhao
1 file changed, 12 insertions(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 736107fad..8cea6baa1 100644
+index b44b9b2d7..7b717d3ba 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
-@@ -341,6 +341,9 @@ fs_getattr_tmpfs(systemd_backlight_t)
+@@ -373,6 +373,9 @@ files_search_var_lib(systemd_backlight_t)
+ fs_getattr_all_fs(systemd_backlight_t)
fs_search_cgroup_dirs(systemd_backlight_t)
- fs_getattr_cgroup(systemd_backlight_t)
+mls_file_read_to_clearance(systemd_backlight_t)
+mls_file_write_to_clearance(systemd_backlight_t)
@@ -56,9 +56,9 @@ index 736107fad..8cea6baa1 100644
#######################################
#
# Binfmt local policy
-@@ -479,6 +482,9 @@ term_use_unallocated_ttys(systemd_generator_t)
+@@ -528,6 +531,9 @@ term_use_unallocated_ttys(systemd_generator_t)
- udev_search_runtime(systemd_generator_t)
+ udev_read_runtime_files(systemd_generator_t)
+mls_file_read_to_clearance(systemd_generator_t)
+mls_file_write_to_clearance(systemd_generator_t)
@@ -66,19 +66,19 @@ index 736107fad..8cea6baa1 100644
ifdef(`distro_gentoo',`
corecmd_shell_entry_type(systemd_generator_t)
')
-@@ -723,6 +729,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
+@@ -922,6 +928,9 @@ userdom_setattr_user_ttys(systemd_logind_t)
userdom_use_user_ttys(systemd_logind_t)
domain_read_all_domains_state(systemd_logind_t)
-+mls_file_read_to_clearance(systemd_logind_t)
-+mls_file_write_to_clearance(systemd_logind_t)
++mls_file_read_all_levels(systemd_logind_t)
++mls_file_write_all_levels(systemd_logind_t)
+
# Needed to work around patch not yet merged into the systemd-logind supported on RHEL 7.x
# The change in systemd by Nicolas Iooss on 02-Feb-2016 with hash 4b51966cf6c06250036e428608da92f8640beb96
# should fix the problem where user directories in /run/user/$UID/ are not getting the proper context
-@@ -1204,6 +1213,9 @@ fs_getattr_tmpfs(systemd_rfkill_t)
- fs_search_cgroup_dirs(systemd_rfkill_t)
- fs_getattr_cgroup(systemd_rfkill_t)
+@@ -1412,6 +1421,9 @@ udev_read_runtime_files(systemd_rfkill_t)
+
+ systemd_log_parse_environment(systemd_rfkill_t)
+mls_file_read_to_clearance(systemd_rfkill_t)
+mls_file_write_to_clearance(systemd_rfkill_t)
@@ -87,5 +87,5 @@ index 736107fad..8cea6baa1 100644
#
# Resolved local policy
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch b/recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
similarity index 78%
rename from recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
rename to recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
index 75be11d..cb3894c 100644
--- a/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
+++ b/recipes-security/refpolicy/refpolicy/0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch
@@ -1,4 +1,4 @@
-From 511f7fdad45a150f7ea3666eb51463573eabab0a Mon Sep 17 00:00:00 2001
+From 2afa5753f2ef8c7cee5ad0511c521d252bedf3e5 Mon Sep 17 00:00:00 2001
From: Xin Ouyang
Date: Thu, 22 Aug 2013 13:37:23 +0800
Subject: [PATCH] policy/modules/system/logging: add the syslogd_t to trusted
@@ -14,18 +14,17 @@ Signed-off-by: Xin Ouyang
Signed-off-by: Joe MacDonald
Signed-off-by: Yi Zhao
---
- policy/modules/system/logging.te | 4 ++++
- 1 file changed, 4 insertions(+)
+ policy/modules/system/logging.te | 3 +++
+ 1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 5b4b5ec5d..e67c25a9e 100644
+index d3b06db7d..f63965d4d 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
-@@ -498,6 +498,10 @@ fs_search_auto_mountpoints(syslogd_t)
- fs_search_tmpfs(syslogd_t)
+@@ -505,6 +505,9 @@ fs_getattr_all_fs(syslogd_t)
+ fs_search_auto_mountpoints(syslogd_t)
mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
-+mls_file_read_all_levels(syslogd_t)
+mls_socket_write_all_levels(syslogd_t) # Need to be able to sendto dgram
+mls_trusted_object(syslogd_t) # Other process need to have the right to connectto/sendto /dev/log
+mls_fd_use_all_levels(syslogd_t)
@@ -33,5 +32,5 @@ index 5b4b5ec5d..e67c25a9e 100644
term_write_console(syslogd_t)
# Allow syslog to a terminal
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch b/recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
similarity index 85%
rename from recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
rename to recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
index 5c01ef4..16f0e4e 100644
--- a/recipes-security/refpolicy/refpolicy/0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
+++ b/recipes-security/refpolicy/refpolicy/0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch
@@ -1,4 +1,4 @@
-From 3f875fae6d9a4538b3e7d33f30dd2a98fc9ea2bd Mon Sep 17 00:00:00 2001
+From f87bb3cb0843af69f9aecaef0a4052e04b15a630 Mon Sep 17 00:00:00 2001
From: Yi Zhao
Date: Tue, 28 May 2019 16:41:37 +0800
Subject: [PATCH] policy/modules/system/init: make init_t MLS trusted for
@@ -17,10 +17,10 @@ Signed-off-by: Yi Zhao
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 36becaa6e..9c0a98eb7 100644
+index fee846cb5..df7f87f17 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
-@@ -218,6 +218,7 @@ mls_file_write_all_levels(init_t)
+@@ -228,6 +228,7 @@ mls_file_write_all_levels(init_t)
mls_process_write_all_levels(init_t)
mls_fd_use_all_levels(init_t)
mls_process_set_level(init_t)
@@ -29,5 +29,5 @@ index 36becaa6e..9c0a98eb7 100644
# MLS trusted for lowering/raising the level of files
mls_file_downgrade(init_t)
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch b/recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch
similarity index 88%
rename from recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch
rename to recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch
index d3ddcd2..fb56eca 100644
--- a/recipes-security/refpolicy/refpolicy/0056-policy-modules-system-init-all-init_t-to-read-any-le.patch
+++ b/recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch
@@ -1,4 +1,4 @@
-From a59dae035b7d5063e0f25c4cf40b5b180ad69022 Mon Sep 17 00:00:00 2001
+From f3c0f18b647631fd2ffc1e86c9e3f51cbf74d60f Mon Sep 17 00:00:00 2001
From: Wenzong Fan
Date: Wed, 3 Feb 2016 04:16:06 -0500
Subject: [PATCH] policy/modules/system/init: all init_t to read any level
@@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao
1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 9c0a98eb7..5a19f0e43 100644
+index df7f87f17..671b5aef3 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
-@@ -224,6 +224,9 @@ mls_key_write_all_levels(init_t)
+@@ -234,6 +234,9 @@ mls_key_write_all_levels(init_t)
mls_file_downgrade(init_t)
mls_file_upgrade(init_t)
@@ -36,5 +36,5 @@ index 9c0a98eb7..5a19f0e43 100644
# otherwise the call fails and sysvinit tries to load the policy
# again when using the initramfs
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch b/recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch
similarity index 87%
rename from recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch
rename to recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch
index 47328be..aa02eb1 100644
--- a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch
+++ b/recipes-security/refpolicy/refpolicy/0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch
@@ -1,4 +1,4 @@
-From 96437ba860d352304246fbe3381030da0665f239 Mon Sep 17 00:00:00 2001
+From cb7a4ff6081f19d05b109512275ec9a537f2f6d2 Mon Sep 17 00:00:00 2001
From: Wenzong Fan
Date: Thu, 25 Feb 2016 04:25:08 -0500
Subject: [PATCH] policy/modules/system/logging: allow auditd_t to write socket
@@ -22,10 +22,10 @@ Signed-off-by: Yi Zhao
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index e67c25a9e..f8d8b73f0 100644
+index f63965d4d..7e41596f4 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
-@@ -215,6 +215,8 @@ miscfiles_read_localization(auditd_t)
+@@ -223,6 +223,8 @@ miscfiles_read_localization(auditd_t)
mls_file_read_all_levels(auditd_t)
mls_file_write_all_levels(auditd_t) # Need to be able to write to /var/run/ directory
@@ -35,5 +35,5 @@ index e67c25a9e..f8d8b73f0 100644
seutil_dontaudit_read_config(auditd_t)
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch b/recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
similarity index 83%
rename from recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
rename to recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
index ad92c7f..16bdf84 100644
--- a/recipes-security/refpolicy/refpolicy/0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
+++ b/recipes-security/refpolicy/refpolicy/0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch
@@ -1,4 +1,4 @@
-From 102255e89863c5a31d0d6c8df67b258d819b9a68 Mon Sep 17 00:00:00 2001
+From 023e7b92a805103c54aec06bbd9465e4fbf7a6f2 Mon Sep 17 00:00:00 2001
From: Yi Zhao
Date: Thu, 31 Oct 2019 17:35:59 +0800
Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS trusted for
@@ -15,10 +15,10 @@ Signed-off-by: Yi Zhao
1 file changed, 1 insertion(+)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
-index 1c53754ee..2031576e0 100644
+index 40cd52825..d08610543 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
-@@ -360,6 +360,7 @@ mls_socket_write_all_levels(kernel_t)
+@@ -372,6 +372,7 @@ mls_socket_write_all_levels(kernel_t)
mls_fd_use_all_levels(kernel_t)
# https://bugzilla.redhat.com/show_bug.cgi?id=667370
mls_file_downgrade(kernel_t)
@@ -27,5 +27,5 @@ index 1c53754ee..2031576e0 100644
ifdef(`distro_redhat',`
# Bugzilla 222337
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch b/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
similarity index 83%
rename from recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
rename to recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
index 96d0588..b916084 100644
--- a/recipes-security/refpolicy/refpolicy/0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
+++ b/recipes-security/refpolicy/refpolicy/0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch
@@ -1,4 +1,4 @@
-From 5fa9e03a3b90f97e573a7724cd9d49b53730d083 Mon Sep 17 00:00:00 2001
+From 55fe90eba640e6d52bb269176f45a3a5e2c3ed80 Mon Sep 17 00:00:00 2001
From: Roy Li
Date: Sat, 22 Feb 2014 13:35:38 +0800
Subject: [PATCH] policy/modules/system/setrans: allow setrans_t use fd at any
@@ -13,10 +13,10 @@ Signed-off-by: Yi Zhao
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/setrans.te b/policy/modules/system/setrans.te
-index 25aadfc5f..564e2d4d1 100644
+index 12e66aad9..5510f7fac 100644
--- a/policy/modules/system/setrans.te
+++ b/policy/modules/system/setrans.te
-@@ -73,6 +73,8 @@ mls_net_receive_all_levels(setrans_t)
+@@ -69,6 +69,8 @@ mls_net_receive_all_levels(setrans_t)
mls_socket_write_all_levels(setrans_t)
mls_process_read_all_levels(setrans_t)
mls_socket_read_all_levels(setrans_t)
@@ -26,5 +26,5 @@ index 25aadfc5f..564e2d4d1 100644
selinux_compute_access_vector(setrans_t)
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch b/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
similarity index 88%
rename from recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
rename to recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
index 8bfe607..c4dc87b 100644
--- a/recipes-security/refpolicy/refpolicy/0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
+++ b/recipes-security/refpolicy/refpolicy/0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch
@@ -1,4 +1,4 @@
-From fe70aaf9a104b4b0c3439d2767eccb0136951f08 Mon Sep 17 00:00:00 2001
+From c9afe0dc30f51f7ad7b93b8878c88df1146272a0 Mon Sep 17 00:00:00 2001
From: Yi Zhao
Date: Mon, 22 Feb 2021 11:28:12 +0800
Subject: [PATCH] policy/modules/system/systemd: make *_systemd_t MLS trusted
@@ -24,10 +24,10 @@ Signed-off-by: Yi Zhao
1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
-index 5c44d8d8a..5f2038f22 100644
+index 325ca548b..b23b9bb0a 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
-@@ -171,6 +171,9 @@ template(`systemd_role_template',`
+@@ -196,6 +196,9 @@ template(`systemd_role_template',`
xdg_read_config_files($1_systemd_t)
xdg_read_data_files($1_systemd_t)
')
@@ -38,5 +38,5 @@ index 5c44d8d8a..5f2038f22 100644
######################################
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch b/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch
similarity index 84%
rename from recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch
rename to recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch
index 7bdc9d6..ab87039 100644
--- a/recipes-security/refpolicy/refpolicy/0061-policy-modules-system-logging-make-syslogd_runtime_t.patch
+++ b/recipes-security/refpolicy/refpolicy/0054-policy-modules-system-logging-make-syslogd_runtime_t.patch
@@ -1,4 +1,4 @@
-From f8a12b28b70689ab520e7ae94d306afe9dcbb556 Mon Sep 17 00:00:00 2001
+From 7a65c9f3636b43f3a29349ea1c045d5281efa5aa Mon Sep 17 00:00:00 2001
From: Yi Zhao
Date: Sat, 18 Dec 2021 17:31:45 +0800
Subject: [PATCH] policy/modules/system/logging: make syslogd_runtime_t MLS
@@ -23,7 +23,7 @@ dev="tmpfs" ino=9854 scontext=system_u:system_r:rpcd_t:s0-s15:c0.c1023
tcontext=system_u:object_r:syslogd_var_run_t:s15:c0.c1023 tclass=dir
permissive=0
-Upstream-Status: Pending
+Upstream-Status: Inappropriate [embedded specific]
Signed-off-by: Yi Zhao
---
@@ -31,18 +31,18 @@ Signed-off-by: Yi Zhao
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index f8d8b73f0..badf56f16 100644
+index 7e41596f4..0c25457d6 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
-@@ -438,6 +438,8 @@ allow syslogd_t syslogd_runtime_t:file map;
+@@ -447,6 +447,8 @@ allow syslogd_t syslogd_runtime_t:file map;
manage_files_pattern(syslogd_t, syslogd_runtime_t, syslogd_runtime_t)
files_runtime_filetrans(syslogd_t, syslogd_runtime_t, file)
+mls_trusted_object(syslogd_runtime_t)
+
- kernel_read_crypto_sysctls(syslogd_t)
kernel_read_system_state(syslogd_t)
kernel_read_network_state(syslogd_t)
+ kernel_read_kernel_sysctls(syslogd_t)
--
-2.17.1
+2.25.1
diff --git a/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch b/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
deleted file mode 100644
index e0db7d3..0000000
--- a/recipes-security/refpolicy/refpolicy/0062-systemd-systemd-resolved-is-linked-to-libselinux.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 52a4222397f5d3b28ca15a45bb2ace209a4afc3e Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge
-Date: Thu, 31 Mar 2022 13:09:10 -0400
-Subject: [PATCH] systemd: systemd-resolved is linked to libselinux
-
-systemd-resolved as of systemd 250 fails to start with this error:
-
-Failed to initialize SELinux labeling handle: No such file or directory
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/3a22db2410de479e5baa88f3f668a7a4ac198950]
-
-Signed-off-by: Kenton Groombridge
-Signed-off-by: Yi Zhao
----
- policy/modules/system/systemd.te | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index 8cea6baa1..beb301cc6 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -1261,6 +1261,7 @@ fs_getattr_cgroup(systemd_resolved_t)
-
- init_dgram_send(systemd_resolved_t)
-
-+seutil_libselinux_linked(systemd_resolved_t)
- seutil_read_file_contexts(systemd_resolved_t)
-
- systemd_log_parse_environment(systemd_resolved_t)
---
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch b/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
deleted file mode 100644
index 63da7cd..0000000
--- a/recipes-security/refpolicy/refpolicy/0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 1ba0911e157c64ea15636c5707f38f1bdc9a46c8 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge
-Date: Wed, 27 Apr 2022 01:09:52 -0400
-Subject: [PATCH] sysnetwork, systemd: allow DNS resolution over
- io.systemd.Resolve
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/1a0acc9c0d8c7c49ad4ca2cabd44bc66450f45e0]
-
-Signed-off-by: Kenton Groombridge
-Signed-off-by: Yi Zhao
----
- policy/modules/system/sysnetwork.if | 1 +
- policy/modules/system/systemd.if | 21 +++++++++++++++++++++
- 2 files changed, 22 insertions(+)
-
-diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if
-index 8664a67c8..140d48508 100644
---- a/policy/modules/system/sysnetwork.if
-+++ b/policy/modules/system/sysnetwork.if
-@@ -844,6 +844,7 @@ interface(`sysnet_dns_name_resolve',`
- ifdef(`init_systemd',`
- optional_policy(`
- systemd_dbus_chat_resolved($1)
-+ systemd_stream_connect_resolved($1)
- ')
- # This seems needed when the mymachines NSS module is used
- optional_policy(`
-diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
-index 5f2038f22..9143fb4c0 100644
---- a/policy/modules/system/systemd.if
-+++ b/policy/modules/system/systemd.if
-@@ -1835,6 +1835,27 @@ interface(`systemd_tmpfilesd_managed',`
- ')
- ')
-
-+#######################################
-+##
-+## Connect to systemd resolved over
-+## /run/systemd/resolve/io.systemd.Resolve .
-+##
-+##
-+##
-+## Domain allowed access.
-+##
-+##
-+#
-+interface(`systemd_stream_connect_resolved',`
-+ gen_require(`
-+ type systemd_resolved_t;
-+ type systemd_resolved_runtime_t;
-+ ')
-+
-+ files_search_runtime($1)
-+ stream_connect_pattern($1, systemd_resolved_runtime_t, systemd_resolved_runtime_t, systemd_resolved_t)
-+')
-+
- ########################################
- ##
- ## Send and receive messages from
---
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch b/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
deleted file mode 100644
index 88f070d..0000000
--- a/recipes-security/refpolicy/refpolicy/0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 50670946f04257cc2110facbc61884e2cf0d8327 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge
-Date: Fri, 6 May 2022 21:16:29 -0400
-Subject: [PATCH] term, init: allow systemd to watch and watch reads on
- unallocated ttys
-
-As of systemd 250, systemd needs to be able to add a watch on and watch
-reads on unallocated ttys in order to start getty.
-
-systemd[55548]: getty@tty1.service: Failed to set up standard input: Permission denied
-systemd[55548]: getty@tty1.service: Failed at step STDIN spawning /sbin/agetty: Permission denied
-
-time->Fri May 6 21:17:58 2022
-type=PROCTITLE msg=audit(1651886278.452:1770): proctitle="(agetty)"
-type=PATH msg=audit(1651886278.452:1770): item=0 name="/dev/tty1" inode=18 dev=00:05 mode=020620 ouid=0 ogid=5 rdev=04:01 obj=system_u:object_r:tty_device_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
-type=CWD msg=audit(1651886278.452:1770): cwd="/"
-type=SYSCALL msg=audit(1651886278.452:1770): arch=c000003e syscall=254 success=no exit=-13 a0=3 a1=60ba5c21e020 a2=18 a3=23 items=1 ppid=1 pid=55551 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(agetty)" exe="/lib/systemd/systemd" subj=system_u:system_r:init_t:s0 key=(null)
-type=AVC msg=audit(1651886278.452:1770): avc: denied { watch watch_reads } for pid=55551 comm="(agetty)" path="/dev/tty1" dev="devtmpfs" ino=18 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tty_device_t:s0 tclass=chr_file permissive=0
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/308ab9f69a4623f5dace8da151e70c6316f055a8]
-
-Signed-off-by: Kenton Groombridge
-Signed-off-by: Yi Zhao
----
- policy/modules/kernel/terminal.if | 38 +++++++++++++++++++++++++++++++
- policy/modules/system/init.te | 2 ++
- 2 files changed, 40 insertions(+)
-
-diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
-index e8c0735eb..6e9f654ac 100644
---- a/policy/modules/kernel/terminal.if
-+++ b/policy/modules/kernel/terminal.if
-@@ -1287,6 +1287,44 @@ interface(`term_dontaudit_use_unallocated_ttys',`
- dontaudit $1 tty_device_t:chr_file rw_chr_file_perms;
- ')
-
-+########################################
-+##
-+## Watch unallocated ttys.
-+##
-+##
-+##
-+## Domain allowed access.
-+##
-+##
-+#
-+interface(`term_watch_unallocated_ttys',`
-+ gen_require(`
-+ type tty_device_t;
-+ ')
-+
-+ dev_list_all_dev_nodes($1)
-+ allow $1 tty_device_t:chr_file watch;
-+')
-+
-+########################################
-+##
-+## Watch reads on unallocated ttys.
-+##
-+##
-+##
-+## Domain allowed access.
-+##
-+##
-+#
-+interface(`term_watch_reads_unallocated_ttys',`
-+ gen_require(`
-+ type tty_device_t;
-+ ')
-+
-+ dev_list_all_dev_nodes($1)
-+ allow $1 tty_device_t:chr_file watch_reads;
-+')
-+
- ########################################
- ##
- ## Get the attributes of all tty device nodes.
-diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index 5a19f0e43..24cef0924 100644
---- a/policy/modules/system/init.te
-+++ b/policy/modules/system/init.te
-@@ -518,6 +518,8 @@ ifdef(`init_systemd',`
- term_create_devpts_dirs(init_t)
- term_create_ptmx(init_t)
- term_create_controlling_term(init_t)
-+ term_watch_unallocated_ttys(init_t)
-+ term_watch_reads_unallocated_ttys(init_t)
-
- # udevd is a "systemd kobject uevent socket activated daemon"
- udev_create_kobject_uevent_sockets(init_t)
---
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch b/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
deleted file mode 100644
index 1029490..0000000
--- a/recipes-security/refpolicy/refpolicy/0065-systemd-add-file-transition-for-systemd-networkd-run.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 6f8a8ecd8bafd6e8a3515b53db2a2982a02ff254 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge
-Date: Thu, 31 Mar 2022 13:22:37 -0400
-Subject: [PATCH] systemd: add file transition for systemd-networkd runtime
-
-systemd-networkd creates the /run/systemd/network directory which should
-be labeled appropriately.
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/663b62f27cb12c22f056eba9326cf3f7f78d8a9e]
-
-Signed-off-by: Kenton Groombridge
-Signed-off-by: Yi Zhao
----
- policy/modules/system/systemd.te | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
-index beb301cc6..654c6a42a 100644
---- a/policy/modules/system/systemd.te
-+++ b/policy/modules/system/systemd.te
-@@ -917,6 +917,7 @@ auth_use_nsswitch(systemd_networkd_t)
-
- init_dgram_send(systemd_networkd_t)
- init_read_state(systemd_networkd_t)
-+init_runtime_filetrans(systemd_networkd_t, systemd_networkd_runtime_t, dir)
-
- logging_send_syslog_msg(systemd_networkd_t)
-
---
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch b/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
deleted file mode 100644
index f84eb4a..0000000
--- a/recipes-security/refpolicy/refpolicy/0066-systemd-add-missing-file-context-for-run-systemd-net.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 2e3f371b59bee343c42e4c69495df0f3719b6e24 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge
-Date: Sat, 2 Apr 2022 15:44:01 -0400
-Subject: [PATCH] systemd: add missing file context for /run/systemd/network
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/f2fe1ae15485da7b6269b7d0d7dbed9a834f1876]
-
-Signed-off-by: Kenton Groombridge
-Signed-off-by: Yi Zhao
----
- policy/modules/system/systemd.fc | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
-index 34db8c034..d21914227 100644
---- a/policy/modules/system/systemd.fc
-+++ b/policy/modules/system/systemd.fc
-@@ -85,6 +85,7 @@ HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_data
-
- /run/systemd/ask-password(/.*)? gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
- /run/systemd/ask-password-block(/.*)? gen_context(system_u:object_r:systemd_passwd_runtime_t,s0)
-+/run/systemd/network(/.*)? gen_context(system_u:object_r:systemd_networkd_runtime_t,s0)
- /run/systemd/resolve(/.*)? gen_context(system_u:object_r:systemd_resolved_runtime_t,s0)
- /run/systemd/seats(/.*)? gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
- /run/systemd/sessions(/.*)? gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
---
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch b/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
deleted file mode 100644
index 0aaf096..0000000
--- a/recipes-security/refpolicy/refpolicy/0067-systemd-add-file-contexts-for-systemd-network-genera.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 143d339b2e6611c56cd0210279757ebee9632731 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge
-Date: Thu, 19 May 2022 11:42:51 -0400
-Subject: [PATCH] systemd: add file contexts for systemd-network-generator
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/73adba0a39b7409bc4bbfa0e962108c2b1e5f2a5]
-
-Thanks-To: Zhao Yi
-Signed-off-by: Kenton Groombridge
-Signed-off-by: Yi Zhao
----
- policy/modules/system/systemd.fc | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
-index d21914227..1a35bd65c 100644
---- a/policy/modules/system/systemd.fc
-+++ b/policy/modules/system/systemd.fc
-@@ -35,6 +35,7 @@
- /usr/lib/systemd/systemd-machined -- gen_context(system_u:object_r:systemd_machined_exec_t,s0)
- /usr/lib/systemd/systemd-modules-load -- gen_context(system_u:object_r:systemd_modules_load_exec_t,s0)
- /usr/lib/systemd/systemd-networkd -- gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
-+/usr/lib/systemd/systemd-network-generator -- gen_context(system_u:object_r:systemd_networkd_exec_t,s0)
- /usr/lib/systemd/systemd-pstore -- gen_context(system_u:object_r:systemd_pstore_exec_t,s0)
- /usr/lib/systemd/systemd-resolved -- gen_context(system_u:object_r:systemd_resolved_exec_t,s0)
- /usr/lib/systemd/systemd-rfkill -- gen_context(system_u:object_r:systemd_rfkill_exec_t,s0)
-@@ -60,6 +61,7 @@ HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_data
- /usr/lib/systemd/system/systemd-backlight.* -- gen_context(system_u:object_r:systemd_backlight_unit_t,s0)
- /usr/lib/systemd/system/systemd-binfmt.* -- gen_context(system_u:object_r:systemd_binfmt_unit_t,s0)
- /usr/lib/systemd/system/systemd-networkd.* gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
-+/usr/lib/systemd/system/systemd-network-generator.* gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
- /usr/lib/systemd/system/systemd-rfkill.* -- gen_context(system_u:object_r:systemd_rfkill_unit_t,s0)
- /usr/lib/systemd/system/systemd-socket-proxyd\.service -- gen_context(system_u:object_r:systemd_socket_proxyd_unit_file_t,s0)
-
---
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch b/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
deleted file mode 100644
index 259863c..0000000
--- a/recipes-security/refpolicy/refpolicy/0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 6508bc8a3440525384fcfcd8ad55a4cd5c79b912 Mon Sep 17 00:00:00 2001
-From: Kenton Groombridge
-Date: Thu, 19 May 2022 11:43:44 -0400
-Subject: [PATCH] systemd, udev: allow udev to read systemd-networkd runtime
-
-udev searches for .link files and applies custom udev rules to devices
-as they come up.
-
-Upstream-Status: Backport
-[https://github.com/SELinuxProject/refpolicy/commit/998ef975f38c70d57e7220b88ae5e62c88ebb770]
-
-Thanks-To: Zhao Yi
-Signed-off-by: Kenton Groombridge
-Signed-off-by: Yi Zhao
----
- policy/modules/system/udev.te | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
-index 4c5a690fb..8e243c0f2 100644
---- a/policy/modules/system/udev.te
-+++ b/policy/modules/system/udev.te
-@@ -270,6 +270,8 @@ ifdef(`init_systemd',`
- systemd_read_hwdb(udev_t)
- systemd_read_logind_sessions_files(udev_t)
- systemd_read_logind_runtime_files(udev_t)
-+ # udev searches for .link files and applies custom udev rules
-+ systemd_read_networkd_runtime(udev_t)
-
- optional_policy(`
- init_dbus_chat(udev_t)
---
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch b/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch
deleted file mode 100644
index 6535a4b..0000000
--- a/recipes-security/refpolicy/refpolicy/0069-fc-fstools-apply-policy-to-findfs-alternative.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 3e3ec39659ae068d20efbb5f13054d90960c3c3f Mon Sep 17 00:00:00 2001
-From: Yi Zhao
-Date: Thu, 19 May 2022 16:51:49 +0800
-Subject: [PATCH] fc/fstools: apply policy to findfs alternative
-
-Add file context for findfs alternative which is provided by util-linux.
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Yi Zhao
----
- policy/modules/system/fstools.fc | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
-index bef711850..91be0ef3d 100644
---- a/policy/modules/system/fstools.fc
-+++ b/policy/modules/system/fstools.fc
-@@ -77,6 +77,7 @@
- /usr/sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/fdisk\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/usr/sbin/findfs\.util-linux -- gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/gdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)
---
-2.25.1
-
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index bb0c0dd..a51312f 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -7,10 +7,10 @@ PROVIDES = "virtual/refpolicy"
RPROVIDES:${PN} = "refpolicy"
# Specific config files for Poky
-SRC_URI += "file://customizable_types \
- file://setrans-mls.conf \
- file://setrans-mcs.conf \
- "
+SRC_URI += "file://customizable_types \
+ file://setrans-mls.conf \
+ file://setrans-mcs.conf \
+ "
# Base patches applied to all Yocto-based platforms. Your own version of
# refpolicy should provide a version of these and place them in your own
@@ -49,64 +49,49 @@ SRC_URI += " \
file://0031-policy-modules-kernel-files-add-rules-for-the-symlin.patch \
file://0032-policy-modules-system-logging-fix-auditd-startup-fai.patch \
file://0033-policy-modules-kernel-terminal-don-t-audit-tty_devic.patch \
- file://0034-policy-modules-system-modutils-allow-mod_t-to-access.patch \
- file://0035-policy-modules-system-getty-allow-getty_t-to-search-.patch \
- file://0036-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch \
- file://0037-policy-modules-admin-usermanage-allow-useradd-to-rel.patch \
- file://0038-policy-modules-system-systemd-enable-support-for-sys.patch \
- file://0039-policy-modules-system-systemd-fix-systemd-resolved-s.patch \
- file://0040-policy-modules-system-systemd-allow-systemd_-_t-to-g.patch \
- file://0041-policy-modules-system-logging-fix-syslogd-failures-f.patch \
- file://0042-policy-modules-system-systemd-systemd-user-fixes.patch \
- file://0043-policy-modules-system-sysnetwork-support-priviledge-.patch \
- file://0044-policy-modules-system-modutils-allow-kmod_t-to-write.patch \
- file://0045-policy-modules-system-systemd-allow-systemd_logind_t.patch \
- file://0046-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \
- file://0047-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \
- file://0048-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \
- file://0049-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch \
- file://0050-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
- file://0051-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
- file://0052-policy-modules-system-systemd-make-systemd-tmpfiles_.patch \
- file://0053-policy-modules-system-systemd-systemd-make-systemd_-.patch \
- file://0054-policy-modules-system-logging-add-the-syslogd_t-to-t.patch \
- file://0055-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
- file://0056-policy-modules-system-init-all-init_t-to-read-any-le.patch \
- file://0057-policy-modules-system-logging-allow-auditd_t-to-writ.patch \
- file://0058-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
- file://0059-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \
- file://0060-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
- file://0061-policy-modules-system-logging-make-syslogd_runtime_t.patch \
- file://0062-systemd-systemd-resolved-is-linked-to-libselinux.patch \
- file://0063-sysnetwork-systemd-allow-DNS-resolution-over-io.syst.patch \
- file://0064-term-init-allow-systemd-to-watch-and-watch-reads-on-.patch \
- file://0065-systemd-add-file-transition-for-systemd-networkd-run.patch \
- file://0066-systemd-add-missing-file-context-for-run-systemd-net.patch \
- file://0067-systemd-add-file-contexts-for-systemd-network-genera.patch \
- file://0068-systemd-udev-allow-udev-to-read-systemd-networkd-run.patch \
- file://0069-fc-fstools-apply-policy-to-findfs-alternative.patch \
+ file://0034-policy-modules-services-rpcbind-allow-rpcbind_t-to-c.patch \
+ file://0035-policy-modules-system-systemd-enable-support-for-sys.patch \
+ file://0036-policy-modules-system-systemd-allow-systemd_logind_t.patch \
+ file://0037-policy-modules-roles-sysadm-allow-sysadm-to-use-init.patch \
+ file://0038-policy-modules-system-systemd-systemd-user-fixes.patch \
+ file://0039-policy-modules-system-mount-make-mount_t-domain-MLS-.patch \
+ file://0040-policy-modules-roles-sysadm-MLS-sysadm-rw-to-clearan.patch \
+ file://0041-policy-modules-services-rpc-make-nfsd_t-domain-MLS-t.patch \
+ file://0042-policy-modules-admin-dmesg-make-dmesg_t-MLS-trusted-.patch \
+ file://0043-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
+ file://0044-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
+ file://0045-policy-modules-system-systemd-make-systemd-tmpfiles_.patch \
+ file://0046-policy-modules-system-systemd-systemd-make-systemd_-.patch \
+ file://0047-policy-modules-system-logging-add-the-syslogd_t-to-t.patch \
+ file://0048-policy-modules-system-init-make-init_t-MLS-trusted-f.patch \
+ file://0049-policy-modules-system-init-all-init_t-to-read-any-le.patch \
+ file://0050-policy-modules-system-logging-allow-auditd_t-to-writ.patch \
+ file://0051-policy-modules-kernel-kernel-make-kernel_t-MLS-trust.patch \
+ file://0052-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \
+ file://0053-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
+ file://0054-policy-modules-system-logging-make-syslogd_runtime_t.patch \
"
S = "${WORKDIR}/refpolicy"
-CONFFILES:${PN} += "${sysconfdir}/selinux/config"
+CONFFILES:${PN} = "${sysconfdir}/selinux/config"
FILES:${PN} += " \
- ${sysconfdir}/selinux/${POLICY_NAME}/ \
- ${datadir}/selinux/${POLICY_NAME}/*.pp \
- ${localstatedir}/lib/selinux/${POLICY_NAME}/ \
- "
+ ${sysconfdir}/selinux/${POLICY_NAME}/ \
+ ${datadir}/selinux/${POLICY_NAME}/*.pp \
+ ${localstatedir}/lib/selinux/${POLICY_NAME}/ \
+ "
FILES:${PN}-dev =+ " \
- ${datadir}/selinux/${POLICY_NAME}/include/ \
- ${sysconfdir}/selinux/sepolgen.conf \
-"
+ ${datadir}/selinux/${POLICY_NAME}/include/ \
+ ${sysconfdir}/selinux/sepolgen.conf \
+ "
EXTRANATIVEPATH += "bzip2-native"
-DEPENDS += "bzip2-replacement-native checkpolicy-native policycoreutils-native semodule-utils-native m4-native"
+DEPENDS = "bzip2-replacement-native checkpolicy-native policycoreutils-native semodule-utils-native m4-native"
-RDEPENDS:${PN}-dev =+ " \
- python3-core \
-"
+RDEPENDS:${PN}-dev = " \
+ python3-core \
+ "
PACKAGE_ARCH = "${MACHINE_ARCH}"
@@ -129,83 +114,83 @@ POLICY_MLS_SENS ?= "16"
POLICY_MLS_CATS ?= "1024"
POLICY_MCS_CATS ?= "1024"
-EXTRA_OEMAKE += "NAME=${POLICY_NAME} \
- TYPE=${POLICY_TYPE} \
- DISTRO=${POLICY_DISTRO} \
- UBAC=${POLICY_UBAC} \
- UNK_PERMS=${POLICY_UNK_PERMS} \
- DIRECT_INITRC=${POLICY_DIRECT_INITRC} \
- SYSTEMD=${POLICY_SYSTEMD} \
- MONOLITHIC=${POLICY_MONOLITHIC} \
- CUSTOM_BUILDOPT=${POLICY_CUSTOM_BUILDOPT} \
- QUIET=${POLICY_QUIET} \
- MLS_SENS=${POLICY_MLS_SENS} \
- MLS_CATS=${POLICY_MLS_CATS} \
- MCS_CATS=${POLICY_MCS_CATS}"
+EXTRA_OEMAKE = "NAME=${POLICY_NAME} \
+ TYPE=${POLICY_TYPE} \
+ DISTRO=${POLICY_DISTRO} \
+ UBAC=${POLICY_UBAC} \
+ UNK_PERMS=${POLICY_UNK_PERMS} \
+ DIRECT_INITRC=${POLICY_DIRECT_INITRC} \
+ SYSTEMD=${POLICY_SYSTEMD} \
+ MONOLITHIC=${POLICY_MONOLITHIC} \
+ CUSTOM_BUILDOPT=${POLICY_CUSTOM_BUILDOPT} \
+ QUIET=${POLICY_QUIET} \
+ MLS_SENS=${POLICY_MLS_SENS} \
+ MLS_CATS=${POLICY_MLS_CATS} \
+ MCS_CATS=${POLICY_MCS_CATS}"
EXTRA_OEMAKE += "tc_usrbindir=${STAGING_BINDIR_NATIVE}"
EXTRA_OEMAKE += "OUTPUT_POLICY=`${STAGING_BINDIR_NATIVE}/checkpolicy -V | cut -d' ' -f1`"
EXTRA_OEMAKE += "CC='${BUILD_CC}' CFLAGS='${BUILD_CFLAGS}' PYTHON='${PYTHON}'"
-python __anonymous () {
+python __anonymous() {
import re
- # make sure DEFAULT_ENFORCING is something sane
+ # Make sure DEFAULT_ENFORCING is something sane
if not re.match('^(enforcing|permissive|disabled)$',
d.getVar('DEFAULT_ENFORCING'),
flags=0):
d.setVar('DEFAULT_ENFORCING', 'permissive')
}
-disable_policy_modules () {
- for module in ${PURGE_POLICY_MODULES} ; do
- sed -i "s/^\(\<${module}\>\) *= *.*$/\1 = off/" ${S}/policy/modules.conf
- done
+disable_policy_modules() {
+ for module in ${PURGE_POLICY_MODULES} ; do
+ sed -i "s/^\(\<${module}\>\) *= *.*$/\1 = off/" ${S}/policy/modules.conf
+ done
}
do_compile() {
- if [ -f "${WORKDIR}/modules.conf" ] ; then
- cp -f ${WORKDIR}/modules.conf ${S}/policy/modules.conf
- fi
- oe_runmake conf
- disable_policy_modules
- oe_runmake policy
+ if [ -f "${WORKDIR}/modules.conf" ] ; then
+ cp -f ${WORKDIR}/modules.conf ${S}/policy/modules.conf
+ fi
+ oe_runmake conf
+ disable_policy_modules
+ oe_runmake policy
}
-prepare_policy_store () {
- oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
- POL_PRIORITY=100
- POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
- POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
- POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
-
- # Prepare to create policy store
- mkdir -p ${POL_STORE}
- mkdir -p ${POL_ACTIVE_MODS}
-
- # get hll type from suffix on base policy module
- HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print $NF}}')
- HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
-
- for i in ${POL_SRC}/*.${HLL_TYPE}; do
- MOD_NAME=$(basename $i | sed "s/\.${HLL_TYPE}$//")
- MOD_DIR=${POL_ACTIVE_MODS}/${MOD_NAME}
- mkdir -p ${MOD_DIR}
- echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
- if ! bzip2 -t $i >/dev/null 2>&1; then
- ${HLL_BIN} $i | bzip2 --stdout > ${MOD_DIR}/cil
- bzip2 -f $i && mv -f $i.bz2 $i
- else
- bunzip2 --stdout $i | \
- ${HLL_BIN} | \
- bzip2 --stdout > ${MOD_DIR}/cil
- fi
- cp $i ${MOD_DIR}/hll
- done
+prepare_policy_store() {
+ oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install
+ POL_PRIORITY=100
+ POL_SRC=${D}${datadir}/selinux/${POLICY_NAME}
+ POL_STORE=${D}${localstatedir}/lib/selinux/${POLICY_NAME}
+ POL_ACTIVE_MODS=${POL_STORE}/active/modules/${POL_PRIORITY}
+
+ # Prepare to create policy store
+ mkdir -p ${POL_STORE}
+ mkdir -p ${POL_ACTIVE_MODS}
+
+ # Get hll type from suffix on base policy module
+ HLL_TYPE=$(echo ${POL_SRC}/base.* | awk -F . '{if (NF>1) {print $NF}}')
+ HLL_BIN=${STAGING_DIR_NATIVE}${prefix}/libexec/selinux/hll/${HLL_TYPE}
+
+ for i in ${POL_SRC}/*.${HLL_TYPE}; do
+ MOD_NAME=$(basename $i | sed "s/\.${HLL_TYPE}$//")
+ MOD_DIR=${POL_ACTIVE_MODS}/${MOD_NAME}
+ mkdir -p ${MOD_DIR}
+ echo -n "${HLL_TYPE}" > ${MOD_DIR}/lang_ext
+ if ! bzip2 -t $i >/dev/null 2>&1; then
+ ${HLL_BIN} $i | bzip2 --stdout > ${MOD_DIR}/cil
+ bzip2 -f $i && mv -f $i.bz2 $i
+ else
+ bunzip2 --stdout $i | \
+ ${HLL_BIN} | \
+ bzip2 --stdout > ${MOD_DIR}/cil
+ fi
+ cp $i ${MOD_DIR}/hll
+ done
}
-rebuild_policy () {
- cat <<-EOF > ${D}${sysconfdir}/selinux/semanage.conf
+rebuild_policy() {
+ cat <<-EOF > ${D}${sysconfdir}/selinux/semanage.conf
module-store = direct
[setfiles]
path = ${STAGING_DIR_NATIVE}${base_sbindir_native}/setfiles
@@ -219,29 +204,29 @@ args = \$@
policy-version = 33
EOF
- # Create policy store and build the policy
- semodule -p ${D} -s ${POLICY_NAME} -n -B
- rm -f ${D}${sysconfdir}/selinux/semanage.conf
- # no need to leave final dir created by semanage laying around
- rm -rf ${D}${localstatedir}/lib/selinux/final
+ # Create policy store and build the policy
+ semodule -p ${D} -s ${POLICY_NAME} -n -B
+ rm -f ${D}${sysconfdir}/selinux/semanage.conf
+ # No need to leave final dir created by semanage laying around
+ rm -rf ${D}${localstatedir}/lib/selinux/final
}
-install_misc_files () {
- cat ${WORKDIR}/customizable_types >> \
- ${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/customizable_types
+install_misc_files() {
+ cat ${WORKDIR}/customizable_types >> \
+ ${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/customizable_types
- # install setrans.conf for mls/mcs policy
- if [ -f ${WORKDIR}/setrans-${POLICY_TYPE}.conf ]; then
- install -m 0644 ${WORKDIR}/setrans-${POLICY_TYPE}.conf \
- ${D}${sysconfdir}/selinux/${POLICY_NAME}/setrans.conf
- fi
+ # Install setrans.conf for mls/mcs policy
+ if [ -f ${WORKDIR}/setrans-${POLICY_TYPE}.conf ]; then
+ install -m 0644 ${WORKDIR}/setrans-${POLICY_TYPE}.conf \
+ ${D}${sysconfdir}/selinux/${POLICY_NAME}/setrans.conf
+ fi
- # install policy headers
- oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install-headers
+ # Install policy headers
+ oe_runmake 'DESTDIR=${D}' 'prefix=${D}${prefix}' install-headers
}
-install_config () {
- echo "\
+install_config() {
+ echo "\
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
@@ -256,22 +241,22 @@ SELINUX=${DEFAULT_ENFORCING}
# mcs - Multi Category Security protection.
SELINUXTYPE=${POLICY_NAME}
" > ${WORKDIR}/config
- install -d ${D}/${sysconfdir}/selinux
- install -m 0644 ${WORKDIR}/config ${D}/${sysconfdir}/selinux/
+ install -d ${D}/${sysconfdir}/selinux
+ install -m 0644 ${WORKDIR}/config ${D}/${sysconfdir}/selinux/
}
-do_install () {
- prepare_policy_store
- rebuild_policy
- install_misc_files
- install_config
+do_install() {
+ prepare_policy_store
+ rebuild_policy
+ install_misc_files
+ install_config
}
-do_install:append(){
- # While building policies on target, Makefile will be searched from SELINUX_DEVEL_PATH
- echo "SELINUX_DEVEL_PATH=${datadir}/selinux/${POLICY_NAME}/include" > ${D}${sysconfdir}/selinux/sepolgen.conf
+do_install:append() {
+ # While building policies on target, Makefile will be searched from SELINUX_DEVEL_PATH
+ echo "SELINUX_DEVEL_PATH=${datadir}/selinux/${POLICY_NAME}/include" > ${D}${sysconfdir}/selinux/sepolgen.conf
}
-sysroot_stage_all:append () {
- sysroot_stage_dir ${D}${sysconfdir} ${SYSROOT_DESTDIR}${sysconfdir}
+sysroot_stage_all:append() {
+ sysroot_stage_dir ${D}${sysconfdir} ${SYSROOT_DESTDIR}${sysconfdir}
}
diff --git a/recipes-security/refpolicy/refpolicy_git.inc b/recipes-security/refpolicy/refpolicy_git.inc
index 9e78aed..54e0890 100644
--- a/recipes-security/refpolicy/refpolicy_git.inc
+++ b/recipes-security/refpolicy/refpolicy_git.inc
@@ -1,8 +1,8 @@
-PV = "2.20210908+git${SRCPV}"
+PV = "2.20221101+git${SRCPV}"
SRC_URI = "git://github.com/SELinuxProject/refpolicy.git;protocol=https;branch=master;name=refpolicy;destsuffix=refpolicy"
-SRCREV_refpolicy ?= "23a8d103f379361cfe63a9ee064564624e108196"
+SRCREV_refpolicy ?= "03d486e306555da161b653c88e804ce23f3a0ea4"
UPSTREAM_CHECK_GITTAGREGEX = "RELEASE_(?P\d+_\d+)"