commit: c7941d5608f8aadd8be1cdda6abff4084b2e094e Author: Jason Zaman via refpolicy <refpolicy <AT> oss <DOT> tresys <DOT> com> AuthorDate: Sun Sep 18 06:38:31 2016 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Mon Oct 3 06:04:21 2016 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=c7941d56
selinuxutil: allow setfiles to read semanage store commit a7334eb0de98af11ec38b6263536fa01bc2a606c libsemanage: validate and compile file contexts before installing validates the fcontexts when they are still in /var/lib/selinux. Without setfiles_t having access to read the files, validation fails and the policy cannot be updated. policy/modules/system/selinuxutil.if | 23 +++++++++++++++++++++++ policy/modules/system/selinuxutil.te | 1 + 2 files changed, 24 insertions(+) diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if index b4c70a3..a8221f0 100644 --- a/policy/modules/system/selinuxutil.if +++ b/policy/modules/system/selinuxutil.if @@ -1107,6 +1107,29 @@ interface(`seutil_run_semanage',` ######################################## ## <summary> +## Read the semanage module store. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`seutil_read_module_store',` + gen_require(` + type selinux_config_t, semanage_store_t; + ') + + files_search_etc($1) + files_search_var($1) + list_dirs_pattern($1, selinux_config_t, semanage_store_t) + list_dirs_pattern($1, semanage_store_t, semanage_store_t) + read_files_pattern($1, semanage_store_t, semanage_store_t) + read_lnk_files_pattern($1, semanage_store_t, semanage_store_t) +') + +######################################## +## <summary> ## Full management of the semanage ## module store. ## </summary> diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te index 4a100cd..98d7840 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -597,6 +597,7 @@ logging_send_syslog_msg(setfiles_t) miscfiles_read_localization(setfiles_t) seutil_libselinux_linked(setfiles_t) +seutil_read_module_store(setfiles_t) userdom_use_all_users_fds(setfiles_t) # for config files in a home directory
