Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package selinux-policy for openSUSE:Factory
checked in at 2021-08-02 12:04:33
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/selinux-policy (Old)
and /work/SRC/openSUSE:Factory/.selinux-policy.new.1899 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "selinux-policy"
Mon Aug 2 12:04:33 2021 rev:15 rq:909370 version:20210716
Changes:
--------
--- /work/SRC/openSUSE:Factory/selinux-policy/selinux-policy.changes
2021-07-12 01:24:55.789280564 +0200
+++ /work/SRC/openSUSE:Factory/.selinux-policy.new.1899/selinux-policy.changes
2021-08-02 12:04:46.097659882 +0200
@@ -1,0 +2,17 @@
+Fri Jul 16 07:11:57 UTC 2021 - Johannes Segitz <jseg...@suse.com>
+
+- Update to version 20210716
+- Remove interfaces for container module before building the package
+ (bsc#1188184)
+- Updated
+ * fix_init.patch
+ * fix_systemd_watch.patch
+ to adapt to upstream changes
+
+-------------------------------------------------------------------
+Thu Jul 15 15:45:57 UTC 2021 - Callum Farmer <gm...@opensuse.org>
+
+- Use tabrmd SELinux modules from tpm2.0-abrmd instead of storing
+ here
+
+-------------------------------------------------------------------
@@ -6,0 +24,24 @@
+
+-------------------------------------------------------------------
+Mon Jun 28 08:11:25 UTC 2021 - Johannes Segitz <jseg...@suse.com>
+
+- Update to version 20210419
+- Dropped fix_gift.patch, module was removed
+- Updated wicked.te to removed dropped interface
+- Refreshed:
+ * fix_cockpit.patch
+ * fix_hadoop.patch
+ * fix_init.patch
+ * fix_logging.patch
+ * fix_logrotate.patch
+ * fix_networkmanager.patch
+ * fix_nscd.patch
+ * fix_rpm.patch
+ * fix_selinuxutil.patch
+ * fix_systemd.patch
+ * fix_systemd_watch.patch
+ * fix_thunderbird.patch
+ * fix_unconfined.patch
+ * fix_unconfineduser.patch
+ * fix_unprivuser.patch
+ * fix_xserver.patch
Old:
----
fedora-policy-20210419.tar.bz2
fix_gift.patch
tabrmd.fc
tabrmd.if
tabrmd.te
New:
----
fedora-policy-20210716.tar.bz2
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ selinux-policy.spec ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:47.441659595 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:47.445659595 +0200
@@ -33,7 +33,7 @@
License: GPL-2.0-or-later
Group: System/Management
Name: selinux-policy
-Version: 20210419
+Version: 20210716
Release: 0
Source: fedora-policy-%{version}.tar.bz2
Source1: selinux-policy-rpmlintrc
@@ -81,13 +81,9 @@
Source126: wicked.te
Source127: wicked.if
Source128: wicked.fc
-Source129: tabrmd.te
-Source130: tabrmd.if
-Source131: tabrmd.fc
Patch001: fix_djbdns.patch
Patch002: fix_dbus.patch
-Patch003: fix_gift.patch
Patch004: fix_java.patch
Patch005: fix_hadoop.patch
Patch006: fix_thunderbird.patch
@@ -424,7 +420,7 @@
cp $i selinux_config
done
-for i in %{SOURCE120} %{SOURCE121} %{SOURCE122} %{SOURCE123} %{SOURCE124}
%{SOURCE125} %{SOURCE126} %{SOURCE127} %{SOURCE128} %{SOURCE129} %{SOURCE130}
%{SOURCE131}; do
+for i in %{SOURCE120} %{SOURCE121} %{SOURCE122} %{SOURCE123} %{SOURCE124}
%{SOURCE125} %{SOURCE126} %{SOURCE127} %{SOURCE128}; do
cp $i policy/modules/contrib
done
@@ -475,6 +471,8 @@
mkdir %{buildroot}%{_datadir}/selinux/devel/html
mv %{buildroot}%{_datadir}/man/man8/*.html
%{buildroot}%{_datadir}/selinux/devel/html
mv %{buildroot}%{_datadir}/man/man8/style.css
%{buildroot}%{_datadir}/selinux/devel/html
+rm %{buildroot}%{_mandir}/man8/container_selinux.8*
+rm %{buildroot}%{_datadir}/selinux/devel/include/services/container.if
%post
if [ ! -s %{_sysconfdir}/selinux/config ]; then
++++++ fedora-policy-20210419.tar.bz2 -> fedora-policy-20210716.tar.bz2 ++++++
++++ 13781 lines of diff (skipped)
++++++ fix_cockpit.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.293659414 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.297659414 +0200
@@ -9,11 +9,11 @@
policy/modules/contrib/cockpit.te | 2 ++
1 file changed, 2 insertions(+)
-diff --git a/policy/modules/contrib/cockpit.te
b/policy/modules/contrib/cockpit.te
-index a160ca6b6..5984711fa 100644
---- a/policy/modules/contrib/cockpit.te
-+++ b/policy/modules/contrib/cockpit.te
-@@ -52,7 +52,9 @@ can_exec(cockpit_ws_t,cockpit_session_exec_t)
+Index: fedora-policy-20210628/policy/modules/contrib/cockpit.te
+===================================================================
+--- fedora-policy-20210628.orig/policy/modules/contrib/cockpit.te
++++ fedora-policy-20210628/policy/modules/contrib/cockpit.te
+@@ -51,7 +51,9 @@ can_exec(cockpit_ws_t,cockpit_session_ex
dev_read_urand(cockpit_ws_t) # for authkey
dev_read_rand(cockpit_ws_t) # for libssh
@@ -23,6 +23,3 @@
# cockpit-ws can connect to other hosts via ssh
corenet_tcp_connect_ssh_port(cockpit_ws_t)
---
-2.26.2
-
++++++ fix_hadoop.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.325659408 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.325659408 +0200
@@ -1,8 +1,8 @@
-Index: fedora-policy-20210419/policy/modules/roles/sysadm.te
+Index: fedora-policy-20210628/policy/modules/roles/sysadm.te
===================================================================
---- fedora-policy-20210419.orig/policy/modules/roles/sysadm.te
-+++ fedora-policy-20210419/policy/modules/roles/sysadm.te
-@@ -298,10 +298,6 @@ optional_policy(`
+--- fedora-policy-20210628.orig/policy/modules/roles/sysadm.te
++++ fedora-policy-20210628/policy/modules/roles/sysadm.te
+@@ -295,10 +295,6 @@ optional_policy(`
')
optional_policy(`
@@ -13,11 +13,11 @@
iotop_run(sysadm_t, sysadm_r)
')
-Index: fedora-policy-20210419/policy/modules/roles/unprivuser.te
+Index: fedora-policy-20210628/policy/modules/roles/unprivuser.te
===================================================================
---- fedora-policy-20210419.orig/policy/modules/roles/unprivuser.te
-+++ fedora-policy-20210419/policy/modules/roles/unprivuser.te
-@@ -209,10 +209,6 @@ ifndef(`distro_redhat',`
+--- fedora-policy-20210628.orig/policy/modules/roles/unprivuser.te
++++ fedora-policy-20210628/policy/modules/roles/unprivuser.te
+@@ -205,10 +205,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`
++++++ fix_init.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.333659406 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.333659406 +0200
@@ -1,8 +1,8 @@
-Index: fedora-policy-20210419/policy/modules/system/init.if
+Index: fedora-policy-20210716/policy/modules/system/init.if
===================================================================
---- fedora-policy-20210419.orig/policy/modules/system/init.if
-+++ fedora-policy-20210419/policy/modules/system/init.if
-@@ -3242,6 +3242,7 @@ interface(`init_filetrans_named_content'
+--- fedora-policy-20210716.orig/policy/modules/system/init.if
++++ fedora-policy-20210716/policy/modules/system/init.if
+@@ -3296,6 +3296,7 @@ interface(`init_filetrans_named_content'
files_etc_filetrans($1, machineid_t, file, "machine-id" )
files_pid_filetrans($1, initctl_t, fifo_file, "fifo" )
init_pid_filetrans($1, systemd_unit_file_t, dir, "generator")
@@ -10,11 +10,11 @@
init_pid_filetrans($1, systemd_unit_file_t, dir, "system")
')
-Index: fedora-policy-20210419/policy/modules/system/init.te
+Index: fedora-policy-20210716/policy/modules/system/init.te
===================================================================
---- fedora-policy-20210419.orig/policy/modules/system/init.te
-+++ fedora-policy-20210419/policy/modules/system/init.te
-@@ -269,6 +269,8 @@ corecmd_exec_bin(init_t)
+--- fedora-policy-20210716.orig/policy/modules/system/init.te
++++ fedora-policy-20210716/policy/modules/system/init.te
+@@ -267,6 +267,8 @@ corecmd_exec_bin(init_t)
corenet_all_recvfrom_netlabel(init_t)
corenet_tcp_bind_all_ports(init_t)
corenet_udp_bind_all_ports(init_t)
@@ -23,7 +23,7 @@
dev_create_all_files(init_t)
dev_create_all_chr_files(init_t)
-@@ -397,6 +399,7 @@ logging_manage_audit_config(init_t)
+@@ -391,6 +393,7 @@ logging_manage_audit_config(init_t)
logging_create_syslog_netlink_audit_socket(init_t)
logging_write_var_log_dirs(init_t)
logging_manage_var_log_symlinks(init_t)
@@ -31,14 +31,13 @@
seutil_read_config(init_t)
seutil_read_login_config(init_t)
-@@ -446,11 +449,16 @@ ifdef(`distro_redhat',`
+@@ -441,10 +444,15 @@ ifdef(`distro_redhat',`
corecmd_shell_domtrans(init_t, initrc_t)
storage_raw_rw_fixed_disk(init_t)
+storage_raw_read_removable_device(init_t)
sysnet_read_dhcpc_state(init_t)
- sysnet_watch_config(init_t)
optional_policy(`
+ networkmanager_initrc_read_lnk_files(init_t)
@@ -48,7 +47,7 @@
bootloader_domtrans(init_t)
')
-@@ -568,10 +576,10 @@ tunable_policy(`init_audit_control',`
+@@ -562,10 +570,10 @@ tunable_policy(`init_audit_control',`
allow init_t self:system all_system_perms;
allow init_t self:system module_load;
allow init_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -61,7 +60,7 @@
allow init_t self:netlink_selinux_socket create_socket_perms;
allow init_t self:unix_dgram_socket lock;
# Until systemd is fixed
-@@ -629,6 +637,7 @@ files_delete_all_spool_sockets(init_t)
+@@ -623,6 +631,7 @@ files_delete_all_spool_sockets(init_t)
files_create_var_lib_dirs(init_t)
files_create_var_lib_symlinks(init_t)
files_read_var_lib_symlinks(init_t)
@@ -69,7 +68,7 @@
files_manage_urandom_seed(init_t)
files_list_locks(init_t)
files_list_spool(init_t)
-@@ -665,7 +674,7 @@ fs_list_all(init_t)
+@@ -659,7 +668,7 @@ fs_list_all(init_t)
fs_list_auto_mountpoints(init_t)
fs_register_binary_executable_type(init_t)
fs_relabel_tmpfs_sock_file(init_t)
@@ -78,7 +77,7 @@
fs_relabel_cgroup_dirs(init_t)
fs_search_cgroup_dirs(init_t)
# for network namespaces
-@@ -721,6 +730,7 @@ systemd_write_inherited_logind_sessions_
+@@ -715,6 +724,7 @@ systemd_write_inherited_logind_sessions_
create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type)
create_dirs_pattern(init_t, var_log_t, var_log_t)
@@ -86,7 +85,7 @@
auth_use_nsswitch(init_t)
auth_rw_login_records(init_t)
-@@ -1574,6 +1584,8 @@ optional_policy(`
+@@ -1556,6 +1566,8 @@ optional_policy(`
optional_policy(`
postfix_list_spool(initrc_t)
++++++ fix_logging.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.369659398 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.369659398 +0200
@@ -1,7 +1,7 @@
-Index: fedora-policy-20210309/policy/modules/system/logging.fc
+Index: fedora-policy-20210628/policy/modules/system/logging.fc
===================================================================
---- fedora-policy-20210309.orig/policy/modules/system/logging.fc
-+++ fedora-policy-20210309/policy/modules/system/logging.fc
+--- fedora-policy-20210628.orig/policy/modules/system/logging.fc
++++ fedora-policy-20210628/policy/modules/system/logging.fc
@@ -3,6 +3,8 @@
/etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
@@ -19,11 +19,11 @@
/var/run/systemd/journal/syslog -s
gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/var/spool/audit(/.*)?
gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
-Index: fedora-policy-20210309/policy/modules/system/logging.if
+Index: fedora-policy-20210628/policy/modules/system/logging.if
===================================================================
---- fedora-policy-20210309.orig/policy/modules/system/logging.if
-+++ fedora-policy-20210309/policy/modules/system/logging.if
-@@ -1722,3 +1722,22 @@ interface(`logging_dgram_send',`
+--- fedora-policy-20210628.orig/policy/modules/system/logging.if
++++ fedora-policy-20210628/policy/modules/system/logging.if
+@@ -1782,3 +1782,22 @@ interface(`logging_dgram_send',`
allow $1 syslogd_t:unix_dgram_socket sendto;
')
++++++ fix_logrotate.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.377659397 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.377659397 +0200
@@ -1,8 +1,8 @@
-Index: fedora-policy/policy/modules/contrib/logrotate.te
+Index: fedora-policy-20210628/policy/modules/contrib/logrotate.te
===================================================================
---- fedora-policy.orig/policy/modules/contrib/logrotate.te
-+++ fedora-policy/policy/modules/contrib/logrotate.te
-@@ -107,6 +107,7 @@ files_var_lib_filetrans(logrotate_t, log
+--- fedora-policy-20210628.orig/policy/modules/contrib/logrotate.te
++++ fedora-policy-20210628/policy/modules/contrib/logrotate.te
+@@ -104,6 +104,7 @@ files_var_lib_filetrans(logrotate_t, log
kernel_read_system_state(logrotate_t)
kernel_read_kernel_sysctls(logrotate_t)
++++++ fix_networkmanager.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.393659393 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.397659392 +0200
@@ -1,16 +1,8 @@
-Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.te
+Index: fedora-policy-20210628/policy/modules/contrib/networkmanager.te
===================================================================
---- fedora-policy-20210419.orig/policy/modules/contrib/networkmanager.te
-+++ fedora-policy-20210419/policy/modules/contrib/networkmanager.te
-@@ -97,6 +97,7 @@ read_files_pattern(NetworkManager_t, Net
- read_lnk_files_pattern(NetworkManager_t, NetworkManager_initrc_exec_t,
NetworkManager_initrc_exec_t)
-
- list_dirs_pattern(NetworkManager_t, NetworkManager_etc_t,
NetworkManager_etc_t)
-+watch_dirs_pattern(NetworkManager_t, NetworkManager_etc_t,
NetworkManager_etc_t)
- read_files_pattern(NetworkManager_t, NetworkManager_etc_t,
NetworkManager_etc_t)
- read_lnk_files_pattern(NetworkManager_t, NetworkManager_etc_t,
NetworkManager_etc_t)
-
-@@ -241,6 +242,9 @@ userdom_read_home_certs(NetworkManager_t
+--- fedora-policy-20210628.orig/policy/modules/contrib/networkmanager.te
++++ fedora-policy-20210628/policy/modules/contrib/networkmanager.te
+@@ -243,6 +243,9 @@ userdom_read_home_certs(NetworkManager_t
userdom_read_user_home_content_files(NetworkManager_t)
userdom_dgram_send(NetworkManager_t)
@@ -20,7 +12,7 @@
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(NetworkManager_t)
')
-@@ -258,6 +262,14 @@ optional_policy(`
+@@ -260,6 +263,14 @@ optional_policy(`
')
optional_policy(`
@@ -35,10 +27,10 @@
bind_domtrans(NetworkManager_t)
bind_manage_cache(NetworkManager_t)
bind_kill(NetworkManager_t)
-Index: fedora-policy-20210419/policy/modules/contrib/networkmanager.if
+Index: fedora-policy-20210628/policy/modules/contrib/networkmanager.if
===================================================================
---- fedora-policy-20210419.orig/policy/modules/contrib/networkmanager.if
-+++ fedora-policy-20210419/policy/modules/contrib/networkmanager.if
+--- fedora-policy-20210628.orig/policy/modules/contrib/networkmanager.if
++++ fedora-policy-20210628/policy/modules/contrib/networkmanager.if
@@ -114,6 +114,24 @@ interface(`networkmanager_initrc_domtran
init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t)
')
++++++ fix_nscd.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.405659390 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.405659390 +0200
@@ -1,7 +1,7 @@
-Index: fedora-policy-20210309/policy/modules/contrib/nscd.fc
+Index: fedora-policy-20210628/policy/modules/contrib/nscd.fc
===================================================================
---- fedora-policy-20210309.orig/policy/modules/contrib/nscd.fc
-+++ fedora-policy-20210309/policy/modules/contrib/nscd.fc
+--- fedora-policy-20210628.orig/policy/modules/contrib/nscd.fc
++++ fedora-policy-20210628/policy/modules/contrib/nscd.fc
@@ -8,8 +8,10 @@
/var/log/nscd\.log.* -- gen_context(system_u:object_r:nscd_log_t,s0)
@@ -14,11 +14,11 @@
/usr/lib/systemd/system/nscd\.service --
gen_context(system_u:object_r:nscd_unit_file_t,s0)
+
-Index: fedora-policy-20210309/policy/modules/contrib/nscd.te
+Index: fedora-policy-20210628/policy/modules/contrib/nscd.te
===================================================================
---- fedora-policy-20210309.orig/policy/modules/contrib/nscd.te
-+++ fedora-policy-20210309/policy/modules/contrib/nscd.te
-@@ -131,6 +131,14 @@ userdom_dontaudit_use_unpriv_user_fds(ns
+--- fedora-policy-20210628.orig/policy/modules/contrib/nscd.te
++++ fedora-policy-20210628/policy/modules/contrib/nscd.te
+@@ -130,6 +130,14 @@ userdom_dontaudit_use_unpriv_user_fds(ns
userdom_dontaudit_search_user_home_dirs(nscd_t)
optional_policy(`
++++++ fix_rpm.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.425659386 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.425659386 +0200
@@ -1,7 +1,7 @@
-Index: fedora-policy-20210309/policy/modules/contrib/rpm.fc
+Index: fedora-policy-20210628/policy/modules/contrib/rpm.fc
===================================================================
---- fedora-policy-20210309.orig/policy/modules/contrib/rpm.fc
-+++ fedora-policy-20210309/policy/modules/contrib/rpm.fc
+--- fedora-policy-20210628.orig/policy/modules/contrib/rpm.fc
++++ fedora-policy-20210628/policy/modules/contrib/rpm.fc
@@ -18,6 +18,10 @@
/usr/bin/repoquery --
gen_context(system_u:object_r:rpm_exec_t,s0)
/usr/bin/zif --
gen_context(system_u:object_r:rpm_exec_t,s0)
@@ -22,11 +22,11 @@
/var/lib/alternatives(/.*)?
gen_context(system_u:object_r:rpm_var_lib_t,s0)
/var/lib/PackageKit(/.*)?
gen_context(system_u:object_r:rpm_var_lib_t,s0)
/var/lib/rpm(/.*)?
gen_context(system_u:object_r:rpm_var_lib_t,s0)
-Index: fedora-policy-20210309/policy/modules/contrib/rpm.if
+Index: fedora-policy-20210628/policy/modules/contrib/rpm.if
===================================================================
---- fedora-policy-20210309.orig/policy/modules/contrib/rpm.if
-+++ fedora-policy-20210309/policy/modules/contrib/rpm.if
-@@ -476,8 +476,10 @@ interface(`rpm_named_filetrans',`
+--- fedora-policy-20210628.orig/policy/modules/contrib/rpm.if
++++ fedora-policy-20210628/policy/modules/contrib/rpm.if
+@@ -479,8 +479,10 @@ interface(`rpm_named_filetrans',`
logging_log_named_filetrans($1, rpm_log_t, file, "yum.log")
logging_log_named_filetrans($1, rpm_log_t, file, "hawkey.log")
logging_log_named_filetrans($1, rpm_log_t, file, "up2date")
@@ -37,10 +37,10 @@
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf")
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum")
files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm")
-Index: fedora-policy-20210309/policy/modules/kernel/files.fc
+Index: fedora-policy-20210628/policy/modules/kernel/files.fc
===================================================================
---- fedora-policy-20210309.orig/policy/modules/kernel/files.fc
-+++ fedora-policy-20210309/policy/modules/kernel/files.fc
+--- fedora-policy-20210628.orig/policy/modules/kernel/files.fc
++++ fedora-policy-20210628/policy/modules/kernel/files.fc
@@ -67,6 +67,7 @@ ifdef(`distro_suse',`
/etc/sysconfig/ipvsadm.* --
gen_context(system_u:object_r:system_conf_t,s0)
/etc/sysconfig/system-config-firewall.* --
gen_context(system_u:object_r:system_conf_t,s0)
++++++ fix_selinuxutil.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.437659384 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.437659384 +0200
@@ -1,7 +1,7 @@
-Index: fedora-policy-20210309/policy/modules/system/selinuxutil.te
+Index: fedora-policy-20210628/policy/modules/system/selinuxutil.te
===================================================================
---- fedora-policy-20210309.orig/policy/modules/system/selinuxutil.te
-+++ fedora-policy-20210309/policy/modules/system/selinuxutil.te
+--- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.te
++++ fedora-policy-20210628/policy/modules/system/selinuxutil.te
@@ -238,6 +238,10 @@ ifdef(`hide_broken_symptoms',`
')
@@ -13,7 +13,7 @@
portage_dontaudit_use_fds(load_policy_t)
')
-@@ -619,6 +623,10 @@ logging_send_audit_msgs(setfiles_t)
+@@ -618,6 +622,10 @@ logging_send_audit_msgs(setfiles_t)
logging_send_syslog_msg(setfiles_t)
optional_policy(`
@@ -24,11 +24,11 @@
cloudform_dontaudit_write_cloud_log(setfiles_t)
')
-Index: fedora-policy-20210309/policy/modules/system/selinuxutil.if
+Index: fedora-policy-20210628/policy/modules/system/selinuxutil.if
===================================================================
---- fedora-policy-20210309.orig/policy/modules/system/selinuxutil.if
-+++ fedora-policy-20210309/policy/modules/system/selinuxutil.if
-@@ -777,6 +777,8 @@ interface(`seutil_dontaudit_read_config'
+--- fedora-policy-20210628.orig/policy/modules/system/selinuxutil.if
++++ fedora-policy-20210628/policy/modules/system/selinuxutil.if
+@@ -795,6 +795,8 @@ interface(`seutil_dontaudit_read_config'
dontaudit $1 selinux_config_t:dir search_dir_perms;
dontaudit $1 selinux_config_t:file read_file_perms;
++++++ fix_systemd.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.457659380 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.457659380 +0200
@@ -1,7 +1,7 @@
-Index: fedora-policy-20210309/policy/modules/system/systemd.te
+Index: fedora-policy-20210628/policy/modules/system/systemd.te
===================================================================
---- fedora-policy-20210309.orig/policy/modules/system/systemd.te
-+++ fedora-policy-20210309/policy/modules/system/systemd.te
+--- fedora-policy-20210628.orig/policy/modules/system/systemd.te
++++ fedora-policy-20210628/policy/modules/system/systemd.te
@@ -347,6 +347,10 @@ userdom_manage_user_tmp_chr_files(system
xserver_dbus_chat(systemd_logind_t)
@@ -13,7 +13,7 @@
apache_read_tmp_files(systemd_logind_t)
')
-@@ -853,6 +857,10 @@ optional_policy(`
+@@ -854,6 +858,10 @@ optional_policy(`
udev_read_pid_files(systemd_hostnamed_t)
')
++++++ fix_systemd_watch.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.465659378 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.465659378 +0200
@@ -1,38 +1,17 @@
-Index: fedora-policy-20210419/policy/modules/system/systemd.te
+Index: fedora-policy-20210716/policy/modules/system/systemd.te
===================================================================
---- fedora-policy-20210419.orig/policy/modules/system/systemd.te
-+++ fedora-policy-20210419/policy/modules/system/systemd.te
-@@ -1357,3 +1357,10 @@ fstools_rw_swap_files(systemd_sleep_t)
-
+--- fedora-policy-20210716.orig/policy/modules/system/systemd.te
++++ fedora-policy-20210716/policy/modules/system/systemd.te
+@@ -1396,6 +1396,12 @@ fstools_rw_swap_files(systemd_sleep_t)
# systemd-sleep needs to getattr swap partitions
storage_getattr_fixed_disk_dev(systemd_sleep_t)
-+
-+
+
+#######################################
+#
+# Allow systemd to watch certificate dir for ca-certificates
+#
+watch_dirs_pattern(init_t,cert_t,cert_t)
-Index: fedora-policy-20210419/policy/modules/system/init.te
-===================================================================
---- fedora-policy-20210419.orig/policy/modules/system/init.te
-+++ fedora-policy-20210419/policy/modules/system/init.te
-@@ -317,7 +317,10 @@ files_etc_filetrans_etc_runtime(init_t,
- # Run /etc/X11/prefdm:
- files_exec_etc_files(init_t)
- files_watch_etc_dirs(init_t)
-+files_watch_etc_files(init_t)
- files_read_usr_files(init_t)
-+files_watch_usr_dirs(init_t)
-+files_watch_usr_files(init_t)
- files_watch_root_dirs(init_t)
- files_write_root_dirs(init_t)
- files_watch_var_dirs(init_t)
-@@ -334,6 +337,7 @@ files_remount_rootfs(init_t)
- files_create_var_dirs(init_t)
- files_watch_home(init_t)
- files_watch_all_pid(init_t)
-+watch_dirs_pattern(init_t,lib_t,lib_t)
-
- fs_list_inotifyfs(init_t)
- # cjp: this may be related to /dev/log
++
+ optional_policy(`
+ sysstat_domtrans(systemd_sleep_t)
+ ')
++++++ fix_thunderbird.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.477659375 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.477659375 +0200
@@ -1,8 +1,8 @@
-Index: fedora-policy/policy/modules/contrib/thunderbird.te
+Index: fedora-policy-20210628/policy/modules/contrib/thunderbird.te
===================================================================
---- fedora-policy.orig/policy/modules/contrib/thunderbird.te
-+++ fedora-policy/policy/modules/contrib/thunderbird.te
-@@ -139,7 +139,6 @@ optional_policy(`
+--- fedora-policy-20210628.orig/policy/modules/contrib/thunderbird.te
++++ fedora-policy-20210628/policy/modules/contrib/thunderbird.te
+@@ -138,7 +138,6 @@ optional_policy(`
optional_policy(`
gnome_stream_connect_gconf(thunderbird_t)
gnome_domtrans_gconfd(thunderbird_t)
++++++ fix_unconfined.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.485659374 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.489659373 +0200
@@ -1,7 +1,7 @@
-Index: fedora-policy/policy/modules/system/unconfined.te
+Index: fedora-policy-20210628/policy/modules/system/unconfined.te
===================================================================
---- fedora-policy.orig/policy/modules/system/unconfined.te
-+++ fedora-policy/policy/modules/system/unconfined.te
+--- fedora-policy-20210628.orig/policy/modules/system/unconfined.te
++++ fedora-policy-20210628/policy/modules/system/unconfined.te
@@ -1,5 +1,10 @@
policy_module(unconfined, 3.5.0)
@@ -13,7 +13,7 @@
########################################
#
# Declarations
-@@ -39,3 +44,6 @@ optional_policy(`
+@@ -41,3 +46,6 @@ optional_policy(`
optional_policy(`
container_runtime_domtrans(unconfined_service_t)
')
++++++ fix_unconfineduser.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.497659371 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.497659371 +0200
@@ -1,8 +1,8 @@
-Index: fedora-policy-20210419/policy/modules/roles/unconfineduser.te
+Index: fedora-policy-20210628/policy/modules/roles/unconfineduser.te
===================================================================
---- fedora-policy-20210419.orig/policy/modules/roles/unconfineduser.te
-+++ fedora-policy-20210419/policy/modules/roles/unconfineduser.te
-@@ -124,6 +124,11 @@ tunable_policy(`unconfined_dyntrans_all'
+--- fedora-policy-20210628.orig/policy/modules/roles/unconfineduser.te
++++ fedora-policy-20210628/policy/modules/roles/unconfineduser.te
+@@ -126,6 +126,11 @@ tunable_policy(`unconfined_dyntrans_all'
domain_dyntrans(unconfined_t)
')
@@ -14,7 +14,7 @@
optional_policy(`
gen_require(`
type unconfined_t;
-@@ -214,6 +219,10 @@ optional_policy(`
+@@ -212,6 +217,10 @@ optional_policy(`
')
optional_policy(`
@@ -25,7 +25,7 @@
chrome_role_notrans(unconfined_r, unconfined_t)
tunable_policy(`unconfined_chrome_sandbox_transition',`
-@@ -248,6 +257,18 @@ optional_policy(`
+@@ -246,6 +255,18 @@ optional_policy(`
dbus_stub(unconfined_t)
optional_policy(`
@@ -44,7 +44,7 @@
bluetooth_dbus_chat(unconfined_t)
')
-@@ -311,6 +332,10 @@ optional_policy(`
+@@ -309,6 +330,10 @@ optional_policy(`
')
optional_policy(`
++++++ fix_unprivuser.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.509659369 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.509659369 +0200
@@ -1,8 +1,8 @@
-Index: fedora-policy-20210419/policy/modules/roles/unprivuser.te
+Index: fedora-policy-20210628/policy/modules/roles/unprivuser.te
===================================================================
---- fedora-policy-20210419.orig/policy/modules/roles/unprivuser.te
-+++ fedora-policy-20210419/policy/modules/roles/unprivuser.te
-@@ -291,6 +291,13 @@ ifndef(`distro_redhat',`
+--- fedora-policy-20210628.orig/policy/modules/roles/unprivuser.te
++++ fedora-policy-20210628/policy/modules/roles/unprivuser.te
+@@ -287,6 +287,13 @@ ifndef(`distro_redhat',`
')
optional_policy(`
++++++ fix_xserver.patch ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.521659366 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.521659366 +0200
@@ -1,7 +1,7 @@
-Index: fedora-policy/policy/modules/services/xserver.fc
+Index: fedora-policy-20210628/policy/modules/services/xserver.fc
===================================================================
---- fedora-policy.orig/policy/modules/services/xserver.fc
-+++ fedora-policy/policy/modules/services/xserver.fc
+--- fedora-policy-20210628.orig/policy/modules/services/xserver.fc
++++ fedora-policy-20210628/policy/modules/services/xserver.fc
@@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
/etc/X11/[wxg]dm/Xsession --
gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0)
@@ -18,7 +18,7 @@
/usr/bin/gpe-dm --
gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
/usr/bin/razor-lightdm-.* -- gen_context(system_u:object_r:xdm_exec_t,s0)
-@@ -135,6 +137,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
+@@ -136,6 +138,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
/usr/X11R6/lib/X11/xkb -d
gen_context(system_u:object_r:xkb_var_lib_t,s0)
/usr/X11R6/lib/X11/xkb/.* -- gen_context(system_u:object_r:xkb_var_lib_t,s0)
@@ -26,11 +26,11 @@
ifndef(`distro_debian',`
/usr/var/[xgkw]dm(/.*)?
gen_context(system_u:object_r:xserver_log_t,s0)
')
-Index: fedora-policy/policy/modules/services/xserver.te
+Index: fedora-policy-20210628/policy/modules/services/xserver.te
===================================================================
---- fedora-policy.orig/policy/modules/services/xserver.te
-+++ fedora-policy/policy/modules/services/xserver.te
-@@ -477,6 +477,10 @@ userdom_delete_user_home_content_files(x
+--- fedora-policy-20210628.orig/policy/modules/services/xserver.te
++++ fedora-policy-20210628/policy/modules/services/xserver.te
+@@ -473,6 +473,10 @@ userdom_delete_user_home_content_files(x
userdom_signull_unpriv_users(xdm_t)
userdom_dontaudit_read_admin_home_lnk_files(xdm_t)
++++++ modules-targeted-base.conf ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.633659342 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.633659342 +0200
@@ -412,10 +412,3 @@
# Policy for wicked
#
wicked = module
-
-# Layer: contrib
-# Module: tabrmd
-#
-# Policy for tabrmd
-#
-tabrmd = module
++++++ update.sh ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.817659303 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.821659302 +0200
@@ -11,7 +11,7 @@
mv selinux-policy fedora-policy-$date
rm -rf fedora-policy-$date/.git*
-mv container-selinux/container.* fedora-policy-$date/policy/modules/contrib/
+mv container-selinux/container.* fedora-policy-$date/policy/modules/services/
rm -f fedora-policy?$date.tar*
tar cf fedora-policy-$date.tar fedora-policy-$date
++++++ wicked.te ++++++
--- /var/tmp/diff_new_pack.2vnCnv/_old 2021-08-02 12:04:48.893659287 +0200
+++ /var/tmp/diff_new_pack.2vnCnv/_new 2021-08-02 12:04:48.893659287 +0200
@@ -327,10 +327,6 @@
')
optional_policy(`
- hal_write_log(wicked_t)
-')
-
-optional_policy(`
howl_signal(wicked_t)
')
