2017-05-07 17:44:55

by Jason Zaman

Subject: [refpolicy] [PATCH 1/4] libraries: update wildcard /usr/lib fcontext

subs_dist takes care of it, the wildcard is no longer needed
---
policy/modules/system/libraries.fc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc
index 94f875d..1e76176 100644
--- a/policy/modules/system/libraries.fc
+++ b/policy/modules/system/libraries.fc
@@ -227,7 +227,7 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_
/usr/lib/ocaml/stublibs/dllnums\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)

# Livna.org packages: xmms-mp3, ffmpeg, xvidcore, xine-lib, gsm, lame
-/usr/lib.*/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/local(/.*)?/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/codecs/drv[1-9c]\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)

--
2.10.2

2017-05-07 17:44:56

by Jason Zaman

Subject: [refpolicy] [PATCH 2/4] appconfig: Add openrc_contexts file

---
Makefile | 2 +-
config/appconfig-mcs/openrc_contexts | 1 +
config/appconfig-mls/openrc_contexts | 1 +
config/appconfig-standard/openrc_contexts | 1 +
4 files changed, 4 insertions(+), 1 deletion(-)
create mode 100644 config/appconfig-mcs/openrc_contexts
create mode 100644 config/appconfig-mls/openrc_contexts
create mode 100644 config/appconfig-standard/openrc_contexts

diff --git a/Makefile b/Makefile
index 2824a75..d19985e 100644
--- a/Makefile
+++ b/Makefile
@@ -255,7 +255,7 @@ seusers := $(appconf)/seusers
appdir := $(contextpath)
user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts)
user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts))))
-appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts sepgsql_contexts x_contexts customizable_types securetty_types lxc_contexts virtual_domain_context virtual_image_context) $(contextpath)/files/media $(fcsubspath) $(user_default_contexts_names)
+appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts sepgsql_contexts x_contexts customizable_types securetty_types lxc_contexts openrc_contexts virtual_domain_context virtual_image_context) $(contextpath)/files/media $(fcsubspath) $(user_default_contexts_names)
net_contexts := $(builddir)net_contexts

all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
diff --git a/config/appconfig-mcs/openrc_contexts b/config/appconfig-mcs/openrc_contexts
new file mode 100644
index 0000000..72f1894
--- /dev/null
+++ b/config/appconfig-mcs/openrc_contexts
@@ -0,0 +1 @@
+run_init=run_init_t
diff --git a/config/appconfig-mls/openrc_contexts b/config/appconfig-mls/openrc_contexts
new file mode 100644
index 0000000..72f1894
--- /dev/null
+++ b/config/appconfig-mls/openrc_contexts
@@ -0,0 +1 @@
+run_init=run_init_t
diff --git a/config/appconfig-standard/openrc_contexts b/config/appconfig-standard/openrc_contexts
new file mode 100644
index 0000000..72f1894
--- /dev/null
+++ b/config/appconfig-standard/openrc_contexts
@@ -0,0 +1 @@
+run_init=run_init_t
--
2.10.2

2017-05-07 17:44:57

by Jason Zaman

Subject: [refpolicy] [PATCH 3/4] dirmngr: add to roles

---
policy/modules/roles/staff.te | 4 ++++
policy/modules/roles/sysadm.te | 4 ++++
policy/modules/roles/unprivuser.te | 4 ++++
3 files changed, 12 insertions(+)

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 27c2fff..0efba38 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -101,6 +101,10 @@ ifndef(`distro_redhat',`
')

optional_policy(`
+ dirmngr_role(staff_r, staff_t)
+ ')
+
+ optional_policy(`
evolution_role(staff_r, staff_t)
')

diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index 54df435..02a1e65 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -1261,6 +1261,10 @@ ifndef(`distro_redhat',`
')

optional_policy(`
+ dirmngr_role(sysadm_r, sysadm_t)
+ ')
+
+ optional_policy(`
evolution_role(sysadm_r, sysadm_t)
')

diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index 1cf53e1..debbfe3 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -70,6 +70,10 @@ ifndef(`distro_redhat',`
')

optional_policy(`
+ dirmngr_role(user_r, user_t)
+ ')
+
+ optional_policy(`
evolution_role(user_r, user_t)
')

--
2.10.2

2017-05-07 17:44:58

by Jason Zaman

Subject: [refpolicy] [PATCH 4/4] corecommands: add consolekit fcontexts

---
policy/modules/kernel/corecommands.fc | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
index d931a31..1033a97 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -171,8 +171,10 @@ ifdef(`distro_gentoo',`
/usr/lib/qt.*/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/wicd/monitor\.py -- gen_context(system_u:object_r:bin_t, s0)
/usr/lib/apt/methods.+ -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/ConsoleKit/.* -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/ConsoleKit/run-seat.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/ConsoleKit/run-session.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/ConsoleKit/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
-/usr/lib/ConsoleKit/run-session.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/courier(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/cups(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/cyrus/.* -- gen_context(system_u:object_r:bin_t,s0)
@@ -327,7 +329,6 @@ ifdef(`distro_gentoo',`
/usr/X11R6/lib(64)?/X11/xkb/xkbcomp -- gen_context(system_u:object_r:bin_t,s0)

ifdef(`distro_debian',`
-/usr/lib/ConsoleKit/.* -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/gdm3/.* -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/udisks/.* -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/bug/.* -- gen_context(system_u:object_r:bin_t,s0)
--
2.10.2

2017-05-11 23:38:29

by Chris PeBenito

Subject: [refpolicy] [PATCH 1/4] libraries: update wildcard /usr/lib fcontext

On 05/07/2017 01:44 PM, Jason Zaman wrote:
> subs_dist takes care of it, the wildcard is no longer needed
> ---
> policy/modules/system/libraries.fc | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc
> index 94f875d..1e76176 100644
> --- a/policy/modules/system/libraries.fc
> +++ b/policy/modules/system/libraries.fc
> @@ -227,7 +227,7 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_
> /usr/lib/ocaml/stublibs/dllnums\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
>
> # Livna.org packages: xmms-mp3, ffmpeg, xvidcore, xine-lib, gsm, lame
> -/usr/lib.*/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
> +/usr/lib/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
> /usr/local(/.*)?/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
> /usr/lib/codecs/drv[1-9c]\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)

Merged.

--
Chris PeBenito

2017-05-11 23:38:39

by Chris PeBenito

Subject: [refpolicy] [PATCH 2/4] appconfig: Add openrc_contexts file

On 05/07/2017 01:44 PM, Jason Zaman wrote:
> ---
> Makefile | 2 +-
> config/appconfig-mcs/openrc_contexts | 1 +
> config/appconfig-mls/openrc_contexts | 1 +
> config/appconfig-standard/openrc_contexts | 1 +
> 4 files changed, 4 insertions(+), 1 deletion(-)
> create mode 100644 config/appconfig-mcs/openrc_contexts
> create mode 100644 config/appconfig-mls/openrc_contexts
> create mode 100644 config/appconfig-standard/openrc_contexts
>
> diff --git a/Makefile b/Makefile
> index 2824a75..d19985e 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -255,7 +255,7 @@ seusers := $(appconf)/seusers
> appdir := $(contextpath)
> user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts)
> user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts))))
> -appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts sepgsql_contexts x_contexts customizable_types securetty_types lxc_contexts virtual_domain_context virtual_image_context) $(contextpath)/files/media $(fcsubspath) $(user_default_contexts_names)
> +appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts sepgsql_contexts x_contexts customizable_types securetty_types lxc_contexts openrc_contexts virtual_domain_context virtual_image_context) $(contextpath)/files/media $(fcsubspath) $(user_default_contexts_names)
> net_contexts := $(builddir)net_contexts
>
> all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
> diff --git a/config/appconfig-mcs/openrc_contexts b/config/appconfig-mcs/openrc_contexts
> new file mode 100644
> index 0000000..72f1894
> --- /dev/null
> +++ b/config/appconfig-mcs/openrc_contexts
> @@ -0,0 +1 @@
> +run_init=run_init_t
> diff --git a/config/appconfig-mls/openrc_contexts b/config/appconfig-mls/openrc_contexts
> new file mode 100644
> index 0000000..72f1894
> --- /dev/null
> +++ b/config/appconfig-mls/openrc_contexts
> @@ -0,0 +1 @@
> +run_init=run_init_t
> diff --git a/config/appconfig-standard/openrc_contexts b/config/appconfig-standard/openrc_contexts
> new file mode 100644
> index 0000000..72f1894
> --- /dev/null
> +++ b/config/appconfig-standard/openrc_contexts
> @@ -0,0 +1 @@
> +run_init=run_init_t

Merged.

--
Chris PeBenito

2017-05-11 23:38:45

by Chris PeBenito

Subject: [refpolicy] [PATCH 4/4] corecommands: add consolekit fcontexts

On 05/07/2017 01:44 PM, Jason Zaman wrote:
> ---
> policy/modules/kernel/corecommands.fc | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
> index d931a31..1033a97 100644
> --- a/policy/modules/kernel/corecommands.fc
> +++ b/policy/modules/kernel/corecommands.fc
> @@ -171,8 +171,10 @@ ifdef(`distro_gentoo',`
> /usr/lib/qt.*/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
> /usr/lib/wicd/monitor\.py -- gen_context(system_u:object_r:bin_t, s0)
> /usr/lib/apt/methods.+ -- gen_context(system_u:object_r:bin_t,s0)
> +/usr/lib/ConsoleKit/.* -- gen_context(system_u:object_r:bin_t,s0)
> +/usr/lib/ConsoleKit/run-seat.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
> +/usr/lib/ConsoleKit/run-session.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
> /usr/lib/ConsoleKit/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
> -/usr/lib/ConsoleKit/run-session.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
> /usr/lib/courier(/.*)? gen_context(system_u:object_r:bin_t,s0)
> /usr/lib/cups(/.*)? gen_context(system_u:object_r:bin_t,s0)
> /usr/lib/cyrus/.* -- gen_context(system_u:object_r:bin_t,s0)
> @@ -327,7 +329,6 @@ ifdef(`distro_gentoo',`
> /usr/X11R6/lib(64)?/X11/xkb/xkbcomp -- gen_context(system_u:object_r:bin_t,s0)
>
> ifdef(`distro_debian',`
> -/usr/lib/ConsoleKit/.* -- gen_context(system_u:object_r:bin_t,s0)
> /usr/lib/gdm3/.* -- gen_context(system_u:object_r:bin_t,s0)
> /usr/lib/udisks/.* -- gen_context(system_u:object_r:bin_t,s0)
> /usr/share/bug/.* -- gen_context(system_u:object_r:bin_t,s0)

Merged.

--
Chris PeBenito