public inbox for gentoo-commits@lists.gentoo.org
 help / color / mirror / Atom feed
* [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/
@ 2022-09-03 20:04 Kenton Groombridge
  2022-10-12 13:34 ` [gentoo-commits] proj/hardened-refpolicy:concord-dev " Kenton Groombridge
  0 siblings, 1 reply; 16+ messages in thread
From: Kenton Groombridge @ 2022-09-03 20:04 UTC (permalink / raw
  To: gentoo-commits

commit:     6f537bac5606bd0ad279ab8016c2c8c51476956d
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Mon May 30 22:51:28 2022 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Sat Sep  3 20:04:19 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=6f537bac

iptables: add file context for /usr/libexec/nftables/nftables.sh

Bug: https://bugs.gentoo.org/840230
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/system/iptables.fc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index 6157f313..ab1300db 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -24,6 +24,8 @@
 /usr/bin/xtables-multi			--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/bin/xtables-nft-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 
+/usr/libexec/nftables/nftables\.sh	--	gen_context(system_u:object_r:iptables_exec_t,s0)
+
 /usr/lib/systemd/system/[^/]*arptables.* --	gen_context(system_u:object_r:iptables_unit_t,s0)
 /usr/lib/systemd/system/[^/]*ebtables.*	 --	gen_context(system_u:object_r:iptables_unit_t,s0)
 /usr/lib/systemd/system/[^/]*ip6tables.* --	gen_context(system_u:object_r:iptables_unit_t,s0)


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:concord-dev commit in: policy/modules/system/
@ 2022-10-12 13:35 Kenton Groombridge
  0 siblings, 0 replies; 16+ messages in thread
From: Kenton Groombridge @ 2022-10-12 13:35 UTC (permalink / raw
  To: gentoo-commits

commit:     985e8bcece6c3e6ab5d2cfc3326f2f44eaeb0bb3
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Wed Oct 12 13:32:23 2022 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Wed Oct 12 13:32:23 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=985e8bce

lvm: add file context for dmeventd in /usr/bin

Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/system/lvm.fc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/system/lvm.fc b/policy/modules/system/lvm.fc
index 378970e5..602e810c 100644
--- a/policy/modules/system/lvm.fc
+++ b/policy/modules/system/lvm.fc
@@ -148,5 +148,6 @@
 
 ifdef(`distro_gentoo',`
 # Bug 529430 comment 8
+/usr/bin/dmeventd		--	gen_context(system_u:object_r:lvm_exec_t,s0)
 /usr/sbin/dmeventd		--	gen_context(system_u:object_r:lvm_exec_t,s0)
 ')


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:concord-dev commit in: policy/modules/system/
@ 2022-10-12 13:34 Kenton Groombridge
  0 siblings, 0 replies; 16+ messages in thread
From: Kenton Groombridge @ 2022-10-12 13:34 UTC (permalink / raw
  To: gentoo-commits

commit:     d935f927cd34c1a91d3a8f3c9278baeeef852320
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 27 01:02:21 2021 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Sat Sep  3 20:04:08 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=d935f927

iptables: add file context for saved rules

Bug: https://bugs.gentoo.org/840230
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/system/init.fc     | 1 -
 policy/modules/system/iptables.fc | 5 +++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
index fe661d5d..4a7c0e00 100644
--- a/policy/modules/system/init.fc
+++ b/policy/modules/system/init.fc
@@ -82,7 +82,6 @@ ifdef(`distro_debian',`
 
 ifdef(`distro_gentoo', `
 /var/lib/init\.d(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
-/var/lib/ip6?tables(/.*)?	gen_context(system_u:object_r:initrc_tmp_t,s0)
 
 /run/openrc(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
 /run/svscan\.pid	--	gen_context(system_u:object_r:initrc_runtime_t,s0)

diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index ba65e811..6157f313 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -45,3 +45,8 @@
 /usr/sbin/xtables-legacy-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/xtables-multi			--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/xtables-nft-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+
+ifdef(`distro_gentoo', `
+/var/lib/ip6?tables(/.*)?		gen_context(system_u:object_r:iptables_conf_t,s0)
+/var/lib/nftables(/.*)?			gen_context(system_u:object_r:iptables_conf_t,s0)
+')


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:concord-dev commit in: policy/modules/system/
@ 2022-10-12 13:34 Kenton Groombridge
  0 siblings, 0 replies; 16+ messages in thread
From: Kenton Groombridge @ 2022-10-12 13:34 UTC (permalink / raw
  To: gentoo-commits

commit:     d50193d70d6d2620c82c112a534d36a6ff06e6ea
Author:     Dave Sugar <dsugar100 <AT> gmail <DOT> com>
AuthorDate: Fri Aug 26 12:45:38 2022 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Sat Sep  3 19:07:50 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=d50193d7

systemd: systemd-update-done fix startup issue

Seeing error:

Failed to initalize SELinux labeling handle: No such file or directory

but no denials.  With strace (and looking at source) found it is
opening /etc/selinux/config

openat(AT_FDCWD, "/etc/selinux/config", O_RDONLY|O_CLOEXEC) = 3

but that was dontaudited.

allow systemd_update_done_t file_type:filesystem getattr;
allow systemd_update_done_t selinux_config_t:dir { getattr open search };
dontaudit systemd_update_done_t selinux_config_t:dir { getattr open search };
dontaudit systemd_update_done_t selinux_config_t:file { getattr ioctl lock open read };

These changes fix the issue

Signed-off-by: Dave Sugar <dsugar100 <AT> gmail.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/system/systemd.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 2dc8b901..1eb35aa4 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1752,6 +1752,7 @@ kernel_read_kernel_sysctls(systemd_update_done_t)
 
 selinux_use_status_page(systemd_update_done_t)
 
+seutil_read_config(systemd_update_done_t)
 seutil_read_file_contexts(systemd_update_done_t)
 
 systemd_log_parse_environment(systemd_update_done_t)


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:concord-dev commit in: policy/modules/system/
@ 2022-10-12 13:34 Kenton Groombridge
  0 siblings, 0 replies; 16+ messages in thread
From: Kenton Groombridge @ 2022-10-12 13:34 UTC (permalink / raw
  To: gentoo-commits

commit:     d63d91588adf55e6867440af9b9f6a4fe6c166f6
Author:     Dave Sugar <dsugar100 <AT> gmail <DOT> com>
AuthorDate: Fri Aug 26 02:45:24 2022 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Sat Sep  3 19:07:50 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=d63d9158

systemd: init_t creates systemd-logind 'linger' directory

node=localhost type=AVC msg=audit(1661480051.880:321): avc:  denied  { create } for  pid=1027 comm="(d-logind)" name="linger" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:systemd_logind_var_lib_t:s0 tclass=dir permissive=0

Signed-off-by: Dave Sugar <dsugar100 <AT> gmail.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/system/init.te    |  1 +
 policy/modules/system/systemd.if | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 285ee5b4..9ecaae54 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -551,6 +551,7 @@ ifdef(`init_systemd',`
 
 	optional_policy(`
 		systemd_dbus_chat_logind(init_t)
+		systemd_create_logind_linger_dir(init_t)
 		systemd_search_all_user_keys(init_t)
 		systemd_create_all_user_keys(init_t)
 		systemd_write_all_user_keys(init_t)

diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index f48cc541..2370c729 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -2031,6 +2031,27 @@ interface(`systemd_read_logind_state',`
 	allow systemd_logind_t $1:file read_file_perms;
 ')
 
+########################################
+## <summary>
+##	Allow the specified domain to create
+##	the systemd-logind linger directory with
+##	the correct context.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`systemd_create_logind_linger_dir',`
+	gen_require(`
+		type systemd_logind_var_lib_t;
+	')
+
+	init_var_lib_filetrans($1, systemd_logind_var_lib_t, dir, "linger")
+	allow $1 systemd_logind_var_lib_t:dir create;
+')
+
 ########################################
 ## <summary>
 ##	Allow the specified domain to start systemd


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/
@ 2022-09-03 20:04 Kenton Groombridge
  2022-10-12 13:35 ` [gentoo-commits] proj/hardened-refpolicy:concord-dev " Kenton Groombridge
  0 siblings, 1 reply; 16+ messages in thread
From: Kenton Groombridge @ 2022-09-03 20:04 UTC (permalink / raw
  To: gentoo-commits

commit:     981aa7aa147482d2f70458f0063476fa31869841
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Sat Nov 13 17:41:37 2021 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Sat Sep  3 20:04:37 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=981aa7aa

miscfiles: add file context for /usr/share/ca-certificates

Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/system/miscfiles.fc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/policy/modules/system/miscfiles.fc b/policy/modules/system/miscfiles.fc
index 87a0cae1..3fa37471 100644
--- a/policy/modules/system/miscfiles.fc
+++ b/policy/modules/system/miscfiles.fc
@@ -58,6 +58,9 @@ ifdef(`distro_redhat',`
 
 /usr/share/ssl/certs(/.*)?	gen_context(system_u:object_r:cert_t,s0)
 /usr/share/ssl/private(/.*)?	gen_context(system_u:object_r:cert_t,s0)
+ifdef(`distro_gentoo',`
+/usr/share/ca-certificates(/.*)?	gen_context(system_u:object_r:cert_t,s0)
+')
 
 /usr/X11R6/lib/X11/fonts(/.*)?	gen_context(system_u:object_r:fonts_t,s0)
 


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:concord-dev commit in: policy/modules/system/
@ 2022-06-06 15:15 Kenton Groombridge
  0 siblings, 0 replies; 16+ messages in thread
From: Kenton Groombridge @ 2022-06-06 15:15 UTC (permalink / raw
  To: gentoo-commits

commit:     29ab9f8b5974fbbc4deb98ff4482d577fb6e12a9
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Sat Nov 13 17:41:37 2021 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Mon Jun  6 15:15:16 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=29ab9f8b

miscfiles: add file context for /usr/share/ca-certificates

Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/system/miscfiles.fc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/policy/modules/system/miscfiles.fc b/policy/modules/system/miscfiles.fc
index 87a0cae1..3fa37471 100644
--- a/policy/modules/system/miscfiles.fc
+++ b/policy/modules/system/miscfiles.fc
@@ -58,6 +58,9 @@ ifdef(`distro_redhat',`
 
 /usr/share/ssl/certs(/.*)?	gen_context(system_u:object_r:cert_t,s0)
 /usr/share/ssl/private(/.*)?	gen_context(system_u:object_r:cert_t,s0)
+ifdef(`distro_gentoo',`
+/usr/share/ca-certificates(/.*)?	gen_context(system_u:object_r:cert_t,s0)
+')
 
 /usr/X11R6/lib/X11/fonts(/.*)?	gen_context(system_u:object_r:fonts_t,s0)
 


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:concord-dev commit in: policy/modules/system/
@ 2022-06-06 15:15 Kenton Groombridge
  0 siblings, 0 replies; 16+ messages in thread
From: Kenton Groombridge @ 2022-06-06 15:15 UTC (permalink / raw
  To: gentoo-commits

commit:     8aeb3323b6470c07f3c0fe5d14e86385ff1ab722
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 27 01:02:21 2021 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Mon Jun  6 15:14:39 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=8aeb3323

iptables: add file context for saved rules

Bug: https://bugs.gentoo.org/840230
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/system/init.fc     | 1 -
 policy/modules/system/iptables.fc | 5 +++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
index fe661d5d..4a7c0e00 100644
--- a/policy/modules/system/init.fc
+++ b/policy/modules/system/init.fc
@@ -82,7 +82,6 @@ ifdef(`distro_debian',`
 
 ifdef(`distro_gentoo', `
 /var/lib/init\.d(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
-/var/lib/ip6?tables(/.*)?	gen_context(system_u:object_r:initrc_tmp_t,s0)
 
 /run/openrc(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
 /run/svscan\.pid	--	gen_context(system_u:object_r:initrc_runtime_t,s0)

diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index ba65e811..6157f313 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -45,3 +45,8 @@
 /usr/sbin/xtables-legacy-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/xtables-multi			--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/xtables-nft-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+
+ifdef(`distro_gentoo', `
+/var/lib/ip6?tables(/.*)?		gen_context(system_u:object_r:iptables_conf_t,s0)
+/var/lib/nftables(/.*)?			gen_context(system_u:object_r:iptables_conf_t,s0)
+')


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:concord-dev commit in: policy/modules/system/
@ 2022-06-06 15:15 Kenton Groombridge
  0 siblings, 0 replies; 16+ messages in thread
From: Kenton Groombridge @ 2022-06-06 15:15 UTC (permalink / raw
  To: gentoo-commits

commit:     c5ccb8cad57d6e29624d559d9100915d38a019ae
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Mon May 30 22:51:28 2022 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Mon Jun  6 15:14:53 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=c5ccb8ca

iptables: add file context for /usr/libexec/nftables/nftables.sh

Bug: https://bugs.gentoo.org/840230
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/system/iptables.fc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index 6157f313..ab1300db 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -24,6 +24,8 @@
 /usr/bin/xtables-multi			--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/bin/xtables-nft-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 
+/usr/libexec/nftables/nftables\.sh	--	gen_context(system_u:object_r:iptables_exec_t,s0)
+
 /usr/lib/systemd/system/[^/]*arptables.* --	gen_context(system_u:object_r:iptables_unit_t,s0)
 /usr/lib/systemd/system/[^/]*ebtables.*	 --	gen_context(system_u:object_r:iptables_unit_t,s0)
 /usr/lib/systemd/system/[^/]*ip6tables.* --	gen_context(system_u:object_r:iptables_unit_t,s0)


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:various-20211111 commit in: policy/modules/system/
@ 2022-06-06 15:13 Kenton Groombridge
  2022-06-06 15:13 ` [gentoo-commits] proj/hardened-refpolicy:concord-dev " Kenton Groombridge
  0 siblings, 1 reply; 16+ messages in thread
From: Kenton Groombridge @ 2022-06-06 15:13 UTC (permalink / raw
  To: gentoo-commits

commit:     a9c2b478b7d9d252301d0da8365ac28c1c4c240c
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Sat Nov 13 17:41:37 2021 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Mon Jun  6 15:13:12 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=a9c2b478

miscfiles: add file context for /usr/share/ca-certificates

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>

 policy/modules/system/miscfiles.fc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/policy/modules/system/miscfiles.fc b/policy/modules/system/miscfiles.fc
index 87a0cae1..3fa37471 100644
--- a/policy/modules/system/miscfiles.fc
+++ b/policy/modules/system/miscfiles.fc
@@ -58,6 +58,9 @@ ifdef(`distro_redhat',`
 
 /usr/share/ssl/certs(/.*)?	gen_context(system_u:object_r:cert_t,s0)
 /usr/share/ssl/private(/.*)?	gen_context(system_u:object_r:cert_t,s0)
+ifdef(`distro_gentoo',`
+/usr/share/ca-certificates(/.*)?	gen_context(system_u:object_r:cert_t,s0)
+')
 
 /usr/X11R6/lib/X11/fonts(/.*)?	gen_context(system_u:object_r:fonts_t,s0)
 


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:various-20211111 commit in: policy/modules/system/
@ 2022-06-06 15:13 Kenton Groombridge
  2022-06-06 15:13 ` [gentoo-commits] proj/hardened-refpolicy:concord-dev " Kenton Groombridge
  0 siblings, 1 reply; 16+ messages in thread
From: Kenton Groombridge @ 2022-06-06 15:13 UTC (permalink / raw
  To: gentoo-commits

commit:     8759c1b535b50b190e9df5dfa37425c21ca2d9ce
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 27 01:02:21 2021 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Mon Jun  6 15:12:50 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=8759c1b5

iptables: add file context for saved rules

Bug: https://bugs.gentoo.org/840230
Signed-off-by: Kenton Groombridge <me <AT> concord.sh>

 policy/modules/system/init.fc     | 1 -
 policy/modules/system/iptables.fc | 5 +++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
index fe661d5d..4a7c0e00 100644
--- a/policy/modules/system/init.fc
+++ b/policy/modules/system/init.fc
@@ -82,7 +82,6 @@ ifdef(`distro_debian',`
 
 ifdef(`distro_gentoo', `
 /var/lib/init\.d(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
-/var/lib/ip6?tables(/.*)?	gen_context(system_u:object_r:initrc_tmp_t,s0)
 
 /run/openrc(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
 /run/svscan\.pid	--	gen_context(system_u:object_r:initrc_runtime_t,s0)

diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index ba65e811..6157f313 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -45,3 +45,8 @@
 /usr/sbin/xtables-legacy-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/xtables-multi			--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/xtables-nft-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+
+ifdef(`distro_gentoo', `
+/var/lib/ip6?tables(/.*)?		gen_context(system_u:object_r:iptables_conf_t,s0)
+/var/lib/nftables(/.*)?			gen_context(system_u:object_r:iptables_conf_t,s0)
+')


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:various-20211111 commit in: policy/modules/system/
@ 2022-06-06 15:13 Kenton Groombridge
  2022-06-06 15:13 ` [gentoo-commits] proj/hardened-refpolicy:concord-dev " Kenton Groombridge
  0 siblings, 1 reply; 16+ messages in thread
From: Kenton Groombridge @ 2022-06-06 15:13 UTC (permalink / raw
  To: gentoo-commits

commit:     e1aa42451ef4fea2d62e2705e8f82fc082b21bc9
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Mon May 30 22:51:28 2022 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Mon Jun  6 15:12:54 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=e1aa4245

iptables: add file context for /usr/libexec/nftables/nftables.sh

Bug: https://bugs.gentoo.org/840230
Signed-off-by: Kenton Groombridge <me <AT> concord.sh>

 policy/modules/system/iptables.fc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index 6157f313..ab1300db 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -24,6 +24,8 @@
 /usr/bin/xtables-multi			--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/bin/xtables-nft-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 
+/usr/libexec/nftables/nftables\.sh	--	gen_context(system_u:object_r:iptables_exec_t,s0)
+
 /usr/lib/systemd/system/[^/]*arptables.* --	gen_context(system_u:object_r:iptables_unit_t,s0)
 /usr/lib/systemd/system/[^/]*ebtables.*	 --	gen_context(system_u:object_r:iptables_unit_t,s0)
 /usr/lib/systemd/system/[^/]*ip6tables.* --	gen_context(system_u:object_r:iptables_unit_t,s0)


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:concord-dev commit in: policy/modules/system/
@ 2022-06-06 15:08 Kenton Groombridge
  0 siblings, 0 replies; 16+ messages in thread
From: Kenton Groombridge @ 2022-06-06 15:08 UTC (permalink / raw
  To: gentoo-commits

commit:     4f4ebd1c5cb233511f02d9e5f33fd20cf70a1810
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Sat Nov 13 17:41:37 2021 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Mon Jun  6 15:07:33 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=4f4ebd1c

miscfiles: add file context for /usr/share/ca-certificates

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>

 policy/modules/system/miscfiles.fc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/policy/modules/system/miscfiles.fc b/policy/modules/system/miscfiles.fc
index 87a0cae1..3fa37471 100644
--- a/policy/modules/system/miscfiles.fc
+++ b/policy/modules/system/miscfiles.fc
@@ -58,6 +58,9 @@ ifdef(`distro_redhat',`
 
 /usr/share/ssl/certs(/.*)?	gen_context(system_u:object_r:cert_t,s0)
 /usr/share/ssl/private(/.*)?	gen_context(system_u:object_r:cert_t,s0)
+ifdef(`distro_gentoo',`
+/usr/share/ca-certificates(/.*)?	gen_context(system_u:object_r:cert_t,s0)
+')
 
 /usr/X11R6/lib/X11/fonts(/.*)?	gen_context(system_u:object_r:fonts_t,s0)
 


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:concord-dev commit in: policy/modules/system/
@ 2022-06-06 15:08 Kenton Groombridge
  0 siblings, 0 replies; 16+ messages in thread
From: Kenton Groombridge @ 2022-06-06 15:08 UTC (permalink / raw
  To: gentoo-commits

commit:     3d7762712115cbfe3751c4e7d989d7913f42b784
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Mon May 30 22:51:28 2022 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Mon Jun  6 15:07:38 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=3d776271

iptables: add file context for /usr/libexec/nftables/nftables.sh

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>

 policy/modules/system/iptables.fc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index 6157f313..ab1300db 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -24,6 +24,8 @@
 /usr/bin/xtables-multi			--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/bin/xtables-nft-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 
+/usr/libexec/nftables/nftables\.sh	--	gen_context(system_u:object_r:iptables_exec_t,s0)
+
 /usr/lib/systemd/system/[^/]*arptables.* --	gen_context(system_u:object_r:iptables_unit_t,s0)
 /usr/lib/systemd/system/[^/]*ebtables.*	 --	gen_context(system_u:object_r:iptables_unit_t,s0)
 /usr/lib/systemd/system/[^/]*ip6tables.* --	gen_context(system_u:object_r:iptables_unit_t,s0)


^ permalink raw reply related	[flat|nested] 16+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:concord-dev commit in: policy/modules/system/
@ 2022-06-06 15:08 Kenton Groombridge
  0 siblings, 0 replies; 16+ messages in thread
From: Kenton Groombridge @ 2022-06-06 15:08 UTC (permalink / raw
  To: gentoo-commits

commit:     7ba50b32de5ca3b9a416234e20f1673ca4ab1452
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 27 01:02:21 2021 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Mon Jun  6 15:07:02 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=7ba50b32

iptables: add file context for saved rules

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>

 policy/modules/system/init.fc     | 1 -
 policy/modules/system/iptables.fc | 5 +++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
index fe661d5d..4a7c0e00 100644
--- a/policy/modules/system/init.fc
+++ b/policy/modules/system/init.fc
@@ -82,7 +82,6 @@ ifdef(`distro_debian',`
 
 ifdef(`distro_gentoo', `
 /var/lib/init\.d(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
-/var/lib/ip6?tables(/.*)?	gen_context(system_u:object_r:initrc_tmp_t,s0)
 
 /run/openrc(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
 /run/svscan\.pid	--	gen_context(system_u:object_r:initrc_runtime_t,s0)

diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index ba65e811..6157f313 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -45,3 +45,8 @@
 /usr/sbin/xtables-legacy-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/xtables-multi			--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/xtables-nft-multi		--	gen_context(system_u:object_r:iptables_exec_t,s0)
+
+ifdef(`distro_gentoo', `
+/var/lib/ip6?tables(/.*)?		gen_context(system_u:object_r:iptables_conf_t,s0)
+/var/lib/nftables(/.*)?			gen_context(system_u:object_r:iptables_conf_t,s0)
+')


^ permalink raw reply related	[flat|nested] 16+ messages in thread
end of thread, other threads:[~2022-10-12 13:35 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-09-03 20:04 [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/ Kenton Groombridge
2022-10-12 13:34 ` [gentoo-commits] proj/hardened-refpolicy:concord-dev " Kenton Groombridge
  -- strict thread matches above, loose matches on Subject: below --
2022-10-12 13:35 Kenton Groombridge
2022-10-12 13:34 Kenton Groombridge
2022-10-12 13:34 Kenton Groombridge
2022-10-12 13:34 Kenton Groombridge
2022-09-03 20:04 [gentoo-commits] proj/hardened-refpolicy:master " Kenton Groombridge
2022-10-12 13:35 ` [gentoo-commits] proj/hardened-refpolicy:concord-dev " Kenton Groombridge
2022-06-06 15:15 Kenton Groombridge
2022-06-06 15:15 Kenton Groombridge
2022-06-06 15:15 Kenton Groombridge
2022-06-06 15:13 [gentoo-commits] proj/hardened-refpolicy:various-20211111 " Kenton Groombridge
2022-06-06 15:13 ` [gentoo-commits] proj/hardened-refpolicy:concord-dev " Kenton Groombridge
2022-06-06 15:13 [gentoo-commits] proj/hardened-refpolicy:various-20211111 " Kenton Groombridge
2022-06-06 15:13 ` [gentoo-commits] proj/hardened-refpolicy:concord-dev " Kenton Groombridge
2022-06-06 15:13 [gentoo-commits] proj/hardened-refpolicy:various-20211111 " Kenton Groombridge
2022-06-06 15:13 ` [gentoo-commits] proj/hardened-refpolicy:concord-dev " Kenton Groombridge
2022-06-06 15:08 Kenton Groombridge
2022-06-06 15:08 Kenton Groombridge
2022-06-06 15:08 Kenton Groombridge

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox