Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package selinux-policy for openSUSE:Factory checked in at 2022-10-24 11:13:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/selinux-policy (Old) and /work/SRC/openSUSE:Factory/.selinux-policy.new.2275 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "selinux-policy" Mon Oct 24 11:13:01 2022 rev:35 rq:1030696 version:20220714 Changes: -------- --- /work/SRC/openSUSE:Factory/selinux-policy/selinux-policy.changes 2022-10-22 14:13:34.572807554 +0200 +++ /work/SRC/openSUSE:Factory/.selinux-policy.new.2275/selinux-policy.changes 2022-10-24 11:13:11.335208809 +0200 @@ -2,28 +1,0 @@ -Wed Oct 19 11:45:57 UTC 2022 - Johannes Segitz <jsegitz@suse.com> - -- Update to version 20221019. Refreshed: - * distro_suse_to_distro_redhat.patch - * fix_apache.patch - * fix_chronyd.patch - * fix_cron.patch - * fix_init.patch - * fix_kernel_sysctl.patch - * fix_networkmanager.patch - * fix_rpm.patch - * fix_sysnetwork.patch - * fix_systemd.patch - * fix_systemd_watch.patch - * fix_unconfined.patch - * fix_unconfineduser.patch - * fix_unprivuser.patch - * fix_xserver.patch -- Dropped fix_cockpit.patch as this is now packaged with cockpit itself -- Remove the ipa module, freeip ships their own module -- Added fix_alsa.patch to allow reading of config files in home directories -- Extended fix_networkmanager.patch and fix_postfix.patch to account - for SUSE systems -- Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc - queries the running processes -- Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - -------------------------------------------------------------------- Old: ---- dontaudit_interface_kmod_tmpfs.patch fedora-policy-20221019.tar.bz2 fix_alsa.patch New: ---- fedora-policy-20220714.tar.bz2 fix_cockpit.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ selinux-policy.spec ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:12.467211142 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:12.471211151 +0200 @@ -33,7 +33,7 @@ License: GPL-2.0-or-later Group: System/Management Name: selinux-policy -Version: 20221019 +Version: 20220714 Release: 0 Source: fedora-policy-%{version}.tar.bz2 Source1: selinux-policy-rpmlintrc @@ -132,7 +132,7 @@ Patch050: fix_libraries.patch Patch051: fix_dovecot.patch # https://github.com/cockpit-project/cockpit/pull/15758 -#Patch052: fix_cockpit.patch +Patch052: fix_cockpit.patch Patch053: fix_systemd_watch.patch # kernel specific sysctl.conf (boo#1184804) Patch054: fix_kernel_sysctl.patch @@ -144,8 +144,6 @@ Patch060: fix_dnsmasq.patch Patch061: fix_userdomain.patch Patch062: fix_cloudform.patch -Patch063: fix_alsa.patch -Patch064: dontaudit_interface_kmod_tmpfs.patch Patch100: sedoctool.patch ++++++ distro_suse_to_distro_redhat.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:12.583211381 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:12.587211390 +0200 @@ -1,8 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/contrib/apache.fc -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/apache.fc -+++ fedora-policy-20221019/policy/modules/contrib/apache.fc -@@ -74,7 +74,7 @@ HOME_DIR/((www)|(web)|(public_html))(/.* +diff -r -u fedora-policy-20220714/policy/modules/contrib/apache.fc fedora-policy-20220714_changed/policy/modules/contrib/apache.fc +--- fedora-policy-20220714/policy/modules/contrib/apache.fc 2022-07-14 10:41:34.267983097 +0200 ++++ fedora-policy-20220714_changed/policy/modules/contrib/apache.fc 2022-09-30 09:07:02.245313656 +0200 +@@ -74,7 +74,7 @@ /usr/sbin/suexec -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) /usr/sbin/thttpd -- gen_context(system_u:object_r:httpd_exec_t,s0) @@ -11,11 +10,10 @@ /usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0) ') -Index: fedora-policy-20221019/policy/modules/contrib/cron.fc -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/cron.fc -+++ fedora-policy-20221019/policy/modules/contrib/cron.fc -@@ -51,7 +51,7 @@ ifdef(`distro_gentoo',` +diff -r -u fedora-policy-20220714/policy/modules/contrib/cron.fc fedora-policy-20220714_changed/policy/modules/contrib/cron.fc +--- fedora-policy-20220714/policy/modules/contrib/cron.fc 2022-07-14 10:41:34.279983278 +0200 ++++ fedora-policy-20220714_changed/policy/modules/contrib/cron.fc 2022-09-30 09:07:01.465301514 +0200 +@@ -51,7 +51,7 @@ /var/spool/cron/lastrun/[^/]* -- <<none>> ') @@ -24,7 +22,7 @@ /var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0) /var/spool/cron/lastrun/[^/]* -- <<none>> /var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0) -@@ -70,7 +70,7 @@ ifdef(`distro_gentoo',` +@@ -70,7 +70,7 @@ /var/spool/cron/lastrun/[^/]* -- <<none>> ') @@ -33,11 +31,10 @@ /var/spool/cron/lastrun -d gen_context(system_u:object_r:crond_tmp_t,s0) /var/spool/cron/lastrun/[^/]* -- <<none>> /var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0) -Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/rpm.fc -+++ fedora-policy-20221019/policy/modules/contrib/rpm.fc -@@ -80,7 +80,7 @@ ifdef(`distro_redhat', ` +diff -r -u fedora-policy-20220714/policy/modules/contrib/rpm.fc fedora-policy-20220714_changed/policy/modules/contrib/rpm.fc +--- fedora-policy-20220714/policy/modules/contrib/rpm.fc 2022-07-14 10:41:34.315983821 +0200 ++++ fedora-policy-20220714_changed/policy/modules/contrib/rpm.fc 2022-09-30 09:07:01.713305375 +0200 +@@ -79,7 +79,7 @@ /var/run/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_run_t,s0) # SuSE @@ -46,11 +43,10 @@ /usr/bin/online_update -- gen_context(system_u:object_r:rpm_exec_t,s0) /sbin/yast2 -- gen_context(system_u:object_r:rpm_exec_t,s0) /var/lib/YaST2(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) -Index: fedora-policy-20221019/policy/modules/kernel/corecommands.fc -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/kernel/corecommands.fc -+++ fedora-policy-20221019/policy/modules/kernel/corecommands.fc -@@ -462,7 +462,7 @@ ifdef(`distro_redhat', ` +diff -r -u fedora-policy-20220714/policy/modules/kernel/corecommands.fc fedora-policy-20220714_changed/policy/modules/kernel/corecommands.fc +--- fedora-policy-20220714/policy/modules/kernel/corecommands.fc 2022-07-14 10:41:34.327984002 +0200 ++++ fedora-policy-20220714_changed/policy/modules/kernel/corecommands.fc 2022-09-30 09:07:01.273298522 +0200 +@@ -462,7 +462,7 @@ /usr/share/texmf/texconfig/tcfmgr -- gen_context(system_u:object_r:bin_t,s0) ') @@ -59,7 +55,7 @@ /usr/lib/cron/run-crons -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/samba/classic/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/ssh/.* -- gen_context(system_u:object_r:bin_t,s0) -@@ -491,7 +491,7 @@ ifdef(`distro_suse', ` +@@ -491,7 +491,7 @@ /var/lib/glusterd/hooks/.*/.*\.sh -- gen_context(system_u:object_r:bin_t,s0) /var/lib/glusterd/hooks/.*/.*\.py -- gen_context(system_u:object_r:bin_t,s0) @@ -68,10 +64,9 @@ /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) ') -Index: fedora-policy-20221019/policy/modules/kernel/devices.fc -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/kernel/devices.fc -+++ fedora-policy-20221019/policy/modules/kernel/devices.fc +diff -r -u fedora-policy-20220714/policy/modules/kernel/devices.fc fedora-policy-20220714_changed/policy/modules/kernel/devices.fc +--- fedora-policy-20220714/policy/modules/kernel/devices.fc 2022-07-14 10:41:34.327984002 +0200 ++++ fedora-policy-20220714_changed/policy/modules/kernel/devices.fc 2022-09-30 09:07:01.265298397 +0200 @@ -148,7 +148,7 @@ /dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0) /dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0) @@ -81,11 +76,10 @@ /dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0) ') /dev/vmci -c gen_context(system_u:object_r:vmci_device_t,s0) -Index: fedora-policy-20221019/policy/modules/kernel/files.fc -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/kernel/files.fc -+++ fedora-policy-20221019/policy/modules/kernel/files.fc -@@ -22,7 +22,7 @@ ifdef(`distro_redhat',` +diff -r -u fedora-policy-20220714/policy/modules/kernel/files.fc fedora-policy-20220714_changed/policy/modules/kernel/files.fc +--- fedora-policy-20220714/policy/modules/kernel/files.fc 2022-07-14 10:41:34.331984062 +0200 ++++ fedora-policy-20220714_changed/policy/modules/kernel/files.fc 2022-09-30 09:07:01.289298772 +0200 +@@ -22,7 +22,7 @@ /[^/]+ -- gen_context(system_u:object_r:etc_runtime_t,s0) ') @@ -94,7 +88,7 @@ /success -- gen_context(system_u:object_r:etc_runtime_t,s0) ') -@@ -92,7 +92,7 @@ ifdef(`distro_gentoo', ` +@@ -92,7 +92,7 @@ /etc/env\.d/.* -- gen_context(system_u:object_r:etc_runtime_t,s0) ') @@ -103,11 +97,10 @@ /etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0) ') -Index: fedora-policy-20221019/policy/modules/services/xserver.fc -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/services/xserver.fc -+++ fedora-policy-20221019/policy/modules/services/xserver.fc -@@ -189,7 +189,7 @@ ifndef(`distro_debian',` +diff -r -u fedora-policy-20220714/policy/modules/services/xserver.fc fedora-policy-20220714_changed/policy/modules/services/xserver.fc +--- fedora-policy-20220714/policy/modules/services/xserver.fc 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/services/xserver.fc 2022-09-30 09:07:02.689320566 +0200 +@@ -189,7 +189,7 @@ /var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0) /var/run/systemd/multi-session-x(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) @@ -116,11 +109,10 @@ /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) ') -Index: fedora-policy-20221019/policy/modules/system/authlogin.fc -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/authlogin.fc -+++ fedora-policy-20221019/policy/modules/system/authlogin.fc -@@ -31,7 +31,7 @@ HOME_DIR/\.google_authenticator~ gen_co +diff -r -u fedora-policy-20220714/policy/modules/system/authlogin.fc fedora-policy-20220714_changed/policy/modules/system/authlogin.fc +--- fedora-policy-20220714/policy/modules/system/authlogin.fc 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/authlogin.fc 2022-09-30 09:07:02.761321686 +0200 +@@ -31,7 +31,7 @@ /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) /sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0) /sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0) @@ -129,11 +121,10 @@ /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) ') -Index: fedora-policy-20221019/policy/modules/system/init.fc -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/init.fc -+++ fedora-policy-20221019/policy/modules/system/init.fc -@@ -92,7 +92,7 @@ ifdef(`distro_gentoo', ` +diff -r -u fedora-policy-20220714/policy/modules/system/init.fc fedora-policy-20220714_changed/policy/modules/system/init.fc +--- fedora-policy-20220714/policy/modules/system/init.fc 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/init.fc 2022-09-30 09:07:02.701320753 +0200 +@@ -92,7 +92,7 @@ /var/run/svscan\.pid -- gen_context(system_u:object_r:initrc_var_run_t,s0) ') @@ -142,11 +133,10 @@ /var/run/bootsplashctl -p gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/keymap -- gen_context(system_u:object_r:initrc_var_run_t,s0) /var/run/numlock-on -- gen_context(system_u:object_r:initrc_var_run_t,s0) -Index: fedora-policy-20221019/policy/modules/system/init.te -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/init.te -+++ fedora-policy-20221019/policy/modules/system/init.te -@@ -1334,7 +1334,7 @@ ifdef(`distro_redhat',` +diff -r -u fedora-policy-20220714/policy/modules/system/init.te fedora-policy-20220714_changed/policy/modules/system/init.te +--- fedora-policy-20220714/policy/modules/system/init.te 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/init.te 2022-09-30 09:07:02.725321126 +0200 +@@ -1330,7 +1330,7 @@ ') ') @@ -155,11 +145,10 @@ optional_policy(` # set permissions on /tmp/.X11-unix xserver_setattr_xdm_tmp_dirs(initrc_t) -Index: fedora-policy-20221019/policy/modules/system/libraries.fc -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/libraries.fc -+++ fedora-policy-20221019/policy/modules/system/libraries.fc -@@ -329,7 +329,7 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_ +diff -r -u fedora-policy-20220714/policy/modules/system/libraries.fc fedora-policy-20220714_changed/policy/modules/system/libraries.fc +--- fedora-policy-20220714/policy/modules/system/libraries.fc 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/libraries.fc 2022-09-30 09:07:02.709320877 +0200 +@@ -329,7 +329,7 @@ /var/lib/spamassassin/compiled/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0) /usr/lib/xfce4/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0) @@ -168,11 +157,10 @@ /var/lib/samba/bin/.+\.so(\.[^/]*)* -l gen_context(system_u:object_r:lib_t,s0) ') -Index: fedora-policy-20221019/policy/modules/system/locallogin.te -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/locallogin.te -+++ fedora-policy-20221019/policy/modules/system/locallogin.te -@@ -274,7 +274,7 @@ ifdef(`enable_mls',` +diff -r -u fedora-policy-20220714/policy/modules/system/locallogin.te fedora-policy-20220714_changed/policy/modules/system/locallogin.te +--- fedora-policy-20220714/policy/modules/system/locallogin.te 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/locallogin.te 2022-09-30 09:07:02.757321625 +0200 +@@ -274,7 +274,7 @@ ') # suse and debian do not use pam with sulogin... @@ -181,10 +169,9 @@ ifdef(`distro_debian', `define(`sulogin_no_pam')') allow sulogin_t self:capability sys_tty_config; -Index: fedora-policy-20221019/policy/modules/system/logging.fc -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/logging.fc -+++ fedora-policy-20221019/policy/modules/system/logging.fc +diff -r -u fedora-policy-20220714/policy/modules/system/logging.fc fedora-policy-20220714_changed/policy/modules/system/logging.fc +--- fedora-policy-20220714/policy/modules/system/logging.fc 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/logging.fc 2022-09-30 09:07:02.757321625 +0200 @@ -46,7 +46,7 @@ /var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,mls_systemhigh) /var/lib/syslog-ng.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0) @@ -194,11 +181,10 @@ /var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0) ') -Index: fedora-policy-20221019/policy/modules/system/logging.te -=================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/logging.te -+++ fedora-policy-20221019/policy/modules/system/logging.te -@@ -682,7 +682,7 @@ ifdef(`distro_gentoo',` +diff -r -u fedora-policy-20220714/policy/modules/system/logging.te fedora-policy-20220714_changed/policy/modules/system/logging.te +--- fedora-policy-20220714/policy/modules/system/logging.te 2022-07-14 10:41:34.335984123 +0200 ++++ fedora-policy-20220714_changed/policy/modules/system/logging.te 2022-09-30 09:07:02.709320877 +0200 +@@ -674,7 +674,7 @@ term_dontaudit_setattr_unallocated_ttys(syslogd_t) ') ++++++ fedora-policy-20221019.tar.bz2 -> fedora-policy-20220714.tar.bz2 ++++++ ++++ 4831 lines of diff (skipped) ++++++ fix_apache.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.355212973 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.359212981 +0200 @@ -1,10 +1,10 @@ -Index: fedora-policy-20221019/policy/modules/contrib/apache.if +Index: fedora-policy-20220428/policy/modules/contrib/apache.if =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/apache.if -+++ fedora-policy-20221019/policy/modules/contrib/apache.if -@@ -2007,3 +2007,25 @@ interface(`apache_read_semaphores',` +--- fedora-policy-20220428.orig/policy/modules/contrib/apache.if ++++ fedora-policy-20220428/policy/modules/contrib/apache.if +@@ -1989,3 +1989,25 @@ interface(`apache_ioctl_stream_sockets', - allow $1 httpd_t:sem r_sem_perms; + allow $1 httpd_t:unix_stream_socket ioctl; ') + +####################################### ++++++ fix_chronyd.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.379213023 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.383213031 +0200 @@ -1,8 +1,8 @@ -Index: fedora-policy-20221019/policy/modules/contrib/chronyd.te +Index: fedora-policy-20220714/policy/modules/contrib/chronyd.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/chronyd.te -+++ fedora-policy-20221019/policy/modules/contrib/chronyd.te -@@ -144,6 +144,14 @@ systemd_exec_systemctl(chronyd_t) +--- fedora-policy-20220714.orig/policy/modules/contrib/chronyd.te ++++ fedora-policy-20220714/policy/modules/contrib/chronyd.te +@@ -141,6 +141,14 @@ systemd_exec_systemctl(chronyd_t) userdom_dgram_send(chronyd_t) optional_policy(` @@ -17,10 +17,10 @@ cron_dgram_send(chronyd_t) ') -Index: fedora-policy-20221019/policy/modules/contrib/chronyd.fc +Index: fedora-policy-20220714/policy/modules/contrib/chronyd.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/chronyd.fc -+++ fedora-policy-20221019/policy/modules/contrib/chronyd.fc +--- fedora-policy-20220714.orig/policy/modules/contrib/chronyd.fc ++++ fedora-policy-20220714/policy/modules/contrib/chronyd.fc @@ -6,6 +6,8 @@ /usr/sbin/chronyd -- gen_context(system_u:object_r:chronyd_exec_t,s0) ++++++ fix_cockpit.patch ++++++ From d63e6cf43bfe32d53b371b6920d4c09431647ddd Mon Sep 17 00:00:00 2001 From: Ludwig Nussel <ludwig.nussel@suse.de> Date: Wed, 28 Apr 2021 17:09:49 +0200 Subject: [PATCH] cockpit: allow cockpit socket to bind nodes Looks like this setting is implicit with kerberos enabled. cockpit.socket fails to start if kerberos_enabled=false --- policy/modules/contrib/cockpit.te | 2 ++ 1 file changed, 2 insertions(+) Index: fedora-policy-20210716/policy/modules/contrib/cockpit.te =================================================================== --- fedora-policy-20210716.orig/policy/modules/contrib/cockpit.te +++ fedora-policy-20210716/policy/modules/contrib/cockpit.te @@ -51,7 +51,9 @@ can_exec(cockpit_ws_t,cockpit_session_ex dev_read_urand(cockpit_ws_t) # for authkey dev_read_rand(cockpit_ws_t) # for libssh +# cockpit-ws allows connections on websm port corenet_tcp_bind_websm_port(cockpit_ws_t) +corenet_tcp_bind_generic_node(cockpit_ws_t) # cockpit-ws can connect to other hosts via ssh corenet_tcp_connect_ssh_port(cockpit_ws_t) Index: fedora-policy-20210716/policy/modules/contrib/cockpit.fc =================================================================== --- fedora-policy-20210716.orig/policy/modules/contrib/cockpit.fc +++ fedora-policy-20210716/policy/modules/contrib/cockpit.fc @@ -3,12 +3,12 @@ /usr/lib/systemd/system/cockpit.* -- gen_context(system_u:object_r:cockpit_unit_file_t,s0) /etc/systemd/system/cockpit.* -- gen_context(system_u:object_r:cockpit_unit_file_t,s0) -/usr/libexec/cockpit-ws -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0) -/usr/libexec/cockpit-tls -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0) -/usr/libexec/cockpit-wsinstance-factory -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0) +/usr/lib(exec)?/cockpit-ws -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0) +/usr/lib(exec)?/cockpit-tls -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0) +/usr/lib(exec)?/cockpit-wsinstance-factory -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0) -/usr/libexec/cockpit-session -- gen_context(system_u:object_r:cockpit_session_exec_t,s0) -/usr/libexec/cockpit-ssh -- gen_context(system_u:object_r:cockpit_session_exec_t,s0) +/usr/lib(exec)?/cockpit-session -- gen_context(system_u:object_r:cockpit_session_exec_t,s0) +/usr/lib(exec)?/cockpit-ssh -- gen_context(system_u:object_r:cockpit_session_exec_t,s0) /usr/share/cockpit/motd/update-motd -- gen_context(system_u:object_r:cockpit_ws_exec_t,s0) ++++++ fix_cron.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.407213080 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.411213088 +0200 @@ -1,7 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/contrib/cron.fc +Index: fedora-policy-20220714/policy/modules/contrib/cron.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/cron.fc -+++ fedora-policy-20221019/policy/modules/contrib/cron.fc +--- fedora-policy-20220714.orig/policy/modules/contrib/cron.fc ++++ fedora-policy-20220714/policy/modules/contrib/cron.fc @@ -34,7 +34,7 @@ /var/spool/cron -d gen_context(system_u:object_r:user_cron_spool_t,s0) @@ -32,11 +32,11 @@ -/var/spool/cron/lastrun/[^/]* -- <<none>> -/var/spool/cron/tabs -d gen_context(system_u:object_r:cron_spool_t,s0) -') -Index: fedora-policy-20221019/policy/modules/contrib/cron.if +Index: fedora-policy-20220714/policy/modules/contrib/cron.if =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/cron.if -+++ fedora-policy-20221019/policy/modules/contrib/cron.if -@@ -1075,7 +1075,7 @@ interface(`cron_generic_log_filetrans_lo +--- fedora-policy-20220714.orig/policy/modules/contrib/cron.if ++++ fedora-policy-20220714/policy/modules/contrib/cron.if +@@ -1057,7 +1057,7 @@ interface(`cron_generic_log_filetrans_lo # interface(`cron_system_spool_entrypoint',` gen_require(` ++++++ fix_init.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.443213154 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.447213163 +0200 @@ -1,8 +1,17 @@ -Index: fedora-policy-20221019/policy/modules/system/init.te +Index: fedora-policy-20220714/policy/modules/system/init.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/init.te -+++ fedora-policy-20221019/policy/modules/system/init.te -@@ -269,6 +269,8 @@ corecmd_exec_bin(init_t) +--- fedora-policy-20220714.orig/policy/modules/system/init.te ++++ fedora-policy-20220714/policy/modules/system/init.te +@@ -187,6 +187,8 @@ allow init_t self:bpf { map_create map_r + # setuid (from /sbin/shutdown) + # sys_chroot (from /usr/bin/chroot): now provided by corecmd_chroot_exec_chroot() + ++# bsc#1197610, find a better, generic solution ++allow init_t self:file mounton; + allow init_t self:fifo_file rw_fifo_file_perms; + + allow init_t self:service manage_service_perms; +@@ -267,6 +269,8 @@ corecmd_exec_bin(init_t) corenet_all_recvfrom_netlabel(init_t) corenet_tcp_bind_all_ports(init_t) corenet_udp_bind_all_ports(init_t) @@ -11,7 +20,7 @@ dev_create_all_files(init_t) dev_create_all_chr_files(init_t) -@@ -398,6 +400,7 @@ logging_manage_audit_config(init_t) +@@ -396,6 +400,7 @@ logging_manage_audit_config(init_t) logging_create_syslog_netlink_audit_socket(init_t) logging_write_var_log_dirs(init_t) logging_manage_var_log_symlinks(init_t) @@ -19,7 +28,7 @@ seutil_read_config(init_t) seutil_read_login_config(init_t) -@@ -450,9 +453,19 @@ ifdef(`distro_redhat',` +@@ -448,9 +453,19 @@ ifdef(`distro_redhat',` corecmd_shell_domtrans(init_t, initrc_t) storage_raw_rw_fixed_disk(init_t) @@ -39,7 +48,7 @@ optional_policy(` anaconda_stream_connect(init_t) anaconda_create_unix_stream_sockets(init_t) -@@ -584,10 +597,10 @@ tunable_policy(`init_audit_control',` +@@ -581,10 +596,10 @@ tunable_policy(`init_audit_control',` allow init_t self:system all_system_perms; allow init_t self:system module_load; allow init_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -52,7 +61,7 @@ allow init_t self:netlink_selinux_socket create_socket_perms; allow init_t self:unix_dgram_socket lock; # Until systemd is fixed -@@ -647,6 +660,7 @@ files_delete_all_spool_sockets(init_t) +@@ -643,6 +658,7 @@ files_delete_all_spool_sockets(init_t) files_create_var_lib_dirs(init_t) files_create_var_lib_symlinks(init_t) files_read_var_lib_symlinks(init_t) @@ -60,7 +69,7 @@ files_manage_urandom_seed(init_t) files_list_locks(init_t) files_list_spool(init_t) -@@ -684,7 +698,7 @@ fs_list_all(init_t) +@@ -680,7 +696,7 @@ fs_list_all(init_t) fs_list_auto_mountpoints(init_t) fs_register_binary_executable_type(init_t) fs_relabel_tmpfs_sock_file(init_t) @@ -69,7 +78,7 @@ fs_relabel_cgroup_dirs(init_t) fs_search_cgroup_dirs(init_t) # for network namespaces -@@ -740,6 +754,7 @@ systemd_write_inherited_logind_sessions_ +@@ -736,6 +752,7 @@ systemd_write_inherited_logind_sessions_ create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type) create_dirs_pattern(init_t, var_log_t, var_log_t) @@ -77,7 +86,7 @@ auth_use_nsswitch(init_t) auth_rw_login_records(init_t) -@@ -1596,6 +1611,8 @@ optional_policy(` +@@ -1590,6 +1607,8 @@ optional_policy(` optional_policy(` postfix_list_spool(initrc_t) ++++++ fix_kernel_sysctl.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.471213212 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.475213220 +0200 @@ -1,7 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/kernel/files.fc +Index: fedora-policy-20220624/policy/modules/kernel/files.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/kernel/files.fc -+++ fedora-policy-20221019/policy/modules/kernel/files.fc +--- fedora-policy-20220624.orig/policy/modules/kernel/files.fc ++++ fedora-policy-20220624/policy/modules/kernel/files.fc @@ -242,6 +242,8 @@ ifdef(`distro_redhat',` /usr/lib/ostree-boot(/.*)? gen_context(system_u:object_r:usr_t,s0) /usr/lib/modules(/.*)/vmlinuz -- gen_context(system_u:object_r:usr_t,s0) @@ -11,11 +11,11 @@ /usr/doc(/.*)?/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) -Index: fedora-policy-20221019/policy/modules/system/systemd.te +Index: fedora-policy-20220624/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/systemd.te -+++ fedora-policy-20221019/policy/modules/system/systemd.te -@@ -1105,6 +1105,8 @@ init_stream_connect(systemd_sysctl_t) +--- fedora-policy-20220624.orig/policy/modules/system/systemd.te ++++ fedora-policy-20220624/policy/modules/system/systemd.te +@@ -1052,6 +1052,8 @@ init_stream_connect(systemd_sysctl_t) logging_send_syslog_msg(systemd_sysctl_t) systemd_read_efivarfs(systemd_sysctl_t) ++++++ fix_networkmanager.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.507213286 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.511213294 +0200 @@ -1,8 +1,8 @@ -Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.te +Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.te -+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.te -@@ -275,6 +275,9 @@ userdom_read_home_certs(NetworkManager_t +--- fedora-policy-20220714.orig/policy/modules/contrib/networkmanager.te ++++ fedora-policy-20220714/policy/modules/contrib/networkmanager.te +@@ -276,6 +276,9 @@ userdom_read_home_certs(NetworkManager_t userdom_read_user_home_content_files(NetworkManager_t) userdom_dgram_send(NetworkManager_t) @@ -12,18 +12,7 @@ tunable_policy(`use_nfs_home_dirs',` fs_read_nfs_files(NetworkManager_t) ') -@@ -284,6 +287,10 @@ tunable_policy(`use_samba_home_dirs',` - ') - - optional_policy(` -+ nis_systemctl_ypbind(NetworkManager_t) -+') -+ -+optional_policy(` - avahi_domtrans(NetworkManager_t) - avahi_kill(NetworkManager_t) - avahi_signal(NetworkManager_t) -@@ -292,6 +299,14 @@ optional_policy(` +@@ -293,6 +296,14 @@ optional_policy(` ') optional_policy(` @@ -38,7 +27,7 @@ bind_domtrans(NetworkManager_t) bind_manage_cache(NetworkManager_t) bind_kill(NetworkManager_t) -@@ -419,6 +434,8 @@ optional_policy(` +@@ -420,6 +431,8 @@ optional_policy(` nscd_kill(NetworkManager_t) nscd_initrc_domtrans(NetworkManager_t) nscd_systemctl(NetworkManager_t) @@ -47,7 +36,7 @@ ') optional_policy(` -@@ -606,6 +623,7 @@ files_manage_etc_files(NetworkManager_di +@@ -602,6 +615,7 @@ files_manage_etc_files(NetworkManager_di init_status(NetworkManager_dispatcher_cloud_t) init_status(NetworkManager_dispatcher_ddclient_t) @@ -55,21 +44,10 @@ init_append_stream_sockets(networkmanager_dispatcher_plugin) init_ioctl_stream_sockets(networkmanager_dispatcher_plugin) init_stream_connect(networkmanager_dispatcher_plugin) -@@ -621,6 +639,10 @@ optional_policy(` - ') - - optional_policy(` -+ nscd_shm_use(NetworkManager_dispatcher_chronyc_t) -+') -+ -+optional_policy(` - cloudform_init_domtrans(NetworkManager_dispatcher_cloud_t) - ') - -Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.if +Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.if =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.if -+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.if +--- fedora-policy-20220714.orig/policy/modules/contrib/networkmanager.if ++++ fedora-policy-20220714/policy/modules/contrib/networkmanager.if @@ -132,6 +132,24 @@ interface(`networkmanager_initrc_domtran init_labeled_script_domtrans($1, NetworkManager_initrc_exec_t) ') @@ -95,10 +73,10 @@ ######################################## ## <summary> ## Execute NetworkManager server in the NetworkManager domain. -Index: fedora-policy-20221019/policy/modules/contrib/networkmanager.fc +Index: fedora-policy-20220714/policy/modules/contrib/networkmanager.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/networkmanager.fc -+++ fedora-policy-20221019/policy/modules/contrib/networkmanager.fc +--- fedora-policy-20220714.orig/policy/modules/contrib/networkmanager.fc ++++ fedora-policy-20220714/policy/modules/contrib/networkmanager.fc @@ -24,6 +24,7 @@ /usr/lib/NetworkManager/dispatcher\.d/04-iscsi -- gen_context(system_u:object_r:NetworkManager_dispatcher_iscsid_script_t,s0) /usr/lib/NetworkManager/dispatcher\.d/10-sendmail -- gen_context(system_u:object_r:NetworkManager_dispatcher_sendmail_script_t,s0) ++++++ fix_postfix.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.539213352 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.543213361 +0200 @@ -1,7 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/contrib/postfix.fc +Index: fedora-policy-20220624/policy/modules/contrib/postfix.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/postfix.fc -+++ fedora-policy-20221019/policy/modules/contrib/postfix.fc +--- fedora-policy-20220624.orig/policy/modules/contrib/postfix.fc ++++ fedora-policy-20220624/policy/modules/contrib/postfix.fc @@ -1,37 +1,21 @@ # postfix -/etc/rc\.d/init\.d/postfix -- gen_context(system_u:object_r:postfix_initrc_exec_t,s0) @@ -75,20 +75,11 @@ /var/spool/postfix/private(/.*)? gen_context(system_u:object_r:postfix_private_t,s0) /var/spool/postfix/public(/.*)? gen_context(system_u:object_r:postfix_public_t,s0) /var/spool/postfix/bounce(/.*)? gen_context(system_u:object_r:postfix_spool_bounce_t,s0) -Index: fedora-policy-20221019/policy/modules/contrib/postfix.te +Index: fedora-policy-20220624/policy/modules/contrib/postfix.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/postfix.te -+++ fedora-policy-20221019/policy/modules/contrib/postfix.te -@@ -121,6 +121,8 @@ allow postfix_master_t self:udp_socket c - allow postfix_master_t postfix_etc_t:dir rw_dir_perms; - allow postfix_master_t postfix_etc_t:file rw_file_perms; - mta_filetrans_aliases(postfix_master_t, postfix_etc_t) -+# SUSE also runs this on /etc/alias -+mta_filetrans_aliases(postfix_master_t, etc_t) - - can_exec(postfix_master_t, postfix_exec_t) - -@@ -447,6 +449,14 @@ logging_send_syslog_msg(postfix_map_t) +--- fedora-policy-20220624.orig/policy/modules/contrib/postfix.te ++++ fedora-policy-20220624/policy/modules/contrib/postfix.te +@@ -447,6 +447,14 @@ logging_send_syslog_msg(postfix_map_t) userdom_use_inherited_user_ptys(postfix_map_t) @@ -103,7 +94,7 @@ optional_policy(` locallogin_dontaudit_use_fds(postfix_map_t) ') -@@ -687,6 +697,14 @@ corenet_tcp_connect_spamd_port(postfix_m +@@ -687,6 +695,14 @@ corenet_tcp_connect_spamd_port(postfix_m files_search_all_mountpoints(postfix_smtp_t) optional_policy(` ++++++ fix_rpm.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.555213385 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.559213394 +0200 @@ -1,7 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/contrib/rpm.fc +Index: fedora-policy-20210628/policy/modules/contrib/rpm.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/rpm.fc -+++ fedora-policy-20221019/policy/modules/contrib/rpm.fc +--- fedora-policy-20210628.orig/policy/modules/contrib/rpm.fc ++++ fedora-policy-20210628/policy/modules/contrib/rpm.fc @@ -18,6 +18,10 @@ /usr/bin/repoquery -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/bin/zif -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -13,7 +13,7 @@ /usr/libexec/packagekitd -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/libexec/yumDBUSBackend.py -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/libexec/pegasus/pycmpiLMI_Software-cimprovagt -- gen_context(system_u:object_r:rpm_exec_t,s0) -@@ -56,6 +60,8 @@ ifdef(`distro_redhat', ` +@@ -55,6 +59,8 @@ ifdef(`distro_redhat', ` /var/cache/yum(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0) /var/cache/dnf(/.*)? gen_context(system_u:object_r:rpm_var_cache_t,s0) @@ -22,11 +22,11 @@ /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/PackageKit(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/rpm(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) -Index: fedora-policy-20221019/policy/modules/contrib/rpm.if +Index: fedora-policy-20210628/policy/modules/contrib/rpm.if =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/rpm.if -+++ fedora-policy-20221019/policy/modules/contrib/rpm.if -@@ -515,8 +515,10 @@ interface(`rpm_named_filetrans',` +--- fedora-policy-20210628.orig/policy/modules/contrib/rpm.if ++++ fedora-policy-20210628/policy/modules/contrib/rpm.if +@@ -479,8 +479,10 @@ interface(`rpm_named_filetrans',` logging_log_named_filetrans($1, rpm_log_t, file, "yum.log") logging_log_named_filetrans($1, rpm_log_t, file, "hawkey.log") logging_log_named_filetrans($1, rpm_log_t, file, "up2date") @@ -37,11 +37,11 @@ files_var_lib_filetrans($1, rpm_var_lib_t, dir, "dnf") files_var_lib_filetrans($1, rpm_var_lib_t, dir, "yum") files_var_lib_filetrans($1, rpm_var_lib_t, dir, "rpm") -Index: fedora-policy-20221019/policy/modules/kernel/files.fc +Index: fedora-policy-20210628/policy/modules/kernel/files.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/kernel/files.fc -+++ fedora-policy-20221019/policy/modules/kernel/files.fc -@@ -67,6 +67,7 @@ ifdef(`distro_redhat',` +--- fedora-policy-20210628.orig/policy/modules/kernel/files.fc ++++ fedora-policy-20210628/policy/modules/kernel/files.fc +@@ -67,6 +67,7 @@ ifdef(`distro_suse',` /etc/sysconfig/ipvsadm.* -- gen_context(system_u:object_r:system_conf_t,s0) /etc/sysconfig/system-config-firewall.* -- gen_context(system_u:object_r:system_conf_t,s0) /etc/yum\.repos\.d(/.*)? gen_context(system_u:object_r:system_conf_t,s0) ++++++ fix_snapper.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.579213434 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.583213443 +0200 @@ -1,7 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/contrib/snapper.te +Index: fedora-policy/policy/modules/contrib/snapper.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/snapper.te -+++ fedora-policy-20221019/policy/modules/contrib/snapper.te +--- fedora-policy.orig/policy/modules/contrib/snapper.te ++++ fedora-policy/policy/modules/contrib/snapper.te @@ -18,6 +18,9 @@ files_config_file(snapperd_conf_t) type snapperd_data_t; files_type(snapperd_data_t) @@ -23,7 +23,7 @@ kernel_setsched(snapperd_t) domain_read_all_domains_state(snapperd_t) -@@ -73,6 +80,14 @@ storage_raw_read_fixed_disk(snapperd_t) +@@ -73,6 +80,10 @@ storage_raw_read_fixed_disk(snapperd_t) auth_use_nsswitch(snapperd_t) optional_policy(` @@ -31,17 +31,13 @@ +') + +optional_policy(` -+ rpm_dbus_chat(snapperd_t) -+') -+ -+optional_policy(` cron_system_entry(snapperd_t, snapperd_exec_t) ') -Index: fedora-policy-20221019/policy/modules/contrib/snapper.fc +Index: fedora-policy/policy/modules/contrib/snapper.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/contrib/snapper.fc -+++ fedora-policy-20221019/policy/modules/contrib/snapper.fc +--- fedora-policy.orig/policy/modules/contrib/snapper.fc ++++ fedora-policy/policy/modules/contrib/snapper.fc @@ -7,9 +7,17 @@ /var/log/snapper\.log.* -- gen_context(system_u:object_r:snapperd_log_t,s0) ++++++ fix_sysnetwork.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.599213476 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.603213484 +0200 @@ -1,8 +1,8 @@ -Index: fedora-policy-20221019/policy/modules/system/sysnetwork.fc +Index: fedora-policy/policy/modules/system/sysnetwork.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/sysnetwork.fc -+++ fedora-policy-20221019/policy/modules/system/sysnetwork.fc -@@ -103,6 +103,8 @@ ifdef(`distro_debian',` +--- fedora-policy.orig/policy/modules/system/sysnetwork.fc ++++ fedora-policy/policy/modules/system/sysnetwork.fc +@@ -102,6 +102,8 @@ ifdef(`distro_debian',` /var/run/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0) ') ++++++ fix_systemd.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.615213509 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.619213517 +0200 @@ -1,8 +1,8 @@ -Index: fedora-policy-20221019/policy/modules/system/systemd.te +Index: fedora-policy-20220624/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/systemd.te -+++ fedora-policy-20221019/policy/modules/system/systemd.te -@@ -381,6 +381,10 @@ userdom_manage_user_tmp_chr_files(system +--- fedora-policy-20220624.orig/policy/modules/system/systemd.te ++++ fedora-policy-20220624/policy/modules/system/systemd.te +@@ -355,6 +355,10 @@ userdom_manage_user_tmp_chr_files(system xserver_dbus_chat(systemd_logind_t) optional_policy(` @@ -13,8 +13,8 @@ apache_read_tmp_files(systemd_logind_t) ') -@@ -863,6 +867,10 @@ optional_policy(` - dbus_system_bus_client(systemd_localed_t) +@@ -882,6 +886,10 @@ optional_policy(` + udev_read_pid_files(systemd_hostnamed_t) ') +optional_policy(` @@ -23,8 +23,8 @@ + ####################################### # - # Hostnamed policy -@@ -1158,7 +1166,7 @@ systemd_read_efivarfs(systemd_hwdb_t) + # rfkill policy +@@ -1105,7 +1113,7 @@ systemd_read_efivarfs(systemd_hwdb_t) # systemd_gpt_generator domain # @@ -33,7 +33,7 @@ allow systemd_gpt_generator_t self:netlink_kobject_uevent_socket create_socket_perms; dev_read_sysfs(systemd_gpt_generator_t) -@@ -1185,6 +1193,8 @@ systemd_unit_file_filetrans(systemd_gpt_ +@@ -1127,6 +1135,8 @@ systemd_unit_file_filetrans(systemd_gpt_ systemd_create_unit_file_dirs(systemd_gpt_generator_t) systemd_create_unit_file_lnk(systemd_gpt_generator_t) ++++++ fix_systemd_watch.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.631213542 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.635213550 +0200 @@ -1,8 +1,8 @@ -Index: fedora-policy-20221019/policy/modules/system/systemd.te +Index: fedora-policy-20220714/policy/modules/system/systemd.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/systemd.te -+++ fedora-policy-20221019/policy/modules/system/systemd.te -@@ -1508,6 +1508,12 @@ fstools_rw_swap_files(systemd_sleep_t) +--- fedora-policy-20220714.orig/policy/modules/system/systemd.te ++++ fedora-policy-20220714/policy/modules/system/systemd.te +@@ -1447,6 +1447,12 @@ fstools_rw_swap_files(systemd_sleep_t) storage_getattr_fixed_disk_dev(systemd_sleep_t) storage_getattr_removable_dev(systemd_sleep_t) ++++++ fix_unconfined.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.651213583 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.651213583 +0200 @@ -1,7 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/system/unconfined.te +Index: fedora-policy-20211111/policy/modules/system/unconfined.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/system/unconfined.te -+++ fedora-policy-20221019/policy/modules/system/unconfined.te +--- fedora-policy-20211111.orig/policy/modules/system/unconfined.te ++++ fedora-policy-20211111/policy/modules/system/unconfined.te @@ -1,5 +1,10 @@ policy_module(unconfined, 3.5.0) @@ -13,7 +13,7 @@ ######################################## # # Declarations -@@ -45,3 +50,6 @@ optional_policy(` +@@ -39,3 +44,6 @@ optional_policy(` optional_policy(` container_runtime_domtrans(unconfined_service_t) ') ++++++ fix_unconfineduser.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.667213616 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.671213624 +0200 @@ -1,7 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/roles/unconfineduser.te +Index: fedora-policy-20220509/policy/modules/roles/unconfineduser.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/roles/unconfineduser.te -+++ fedora-policy-20221019/policy/modules/roles/unconfineduser.te +--- fedora-policy-20220509.orig/policy/modules/roles/unconfineduser.te ++++ fedora-policy-20220509/policy/modules/roles/unconfineduser.te @@ -124,6 +124,11 @@ tunable_policy(`unconfined_dyntrans_all' domain_dyntrans(unconfined_t) ') @@ -14,7 +14,7 @@ optional_policy(` gen_require(` type unconfined_t; -@@ -214,6 +219,10 @@ optional_policy(` +@@ -210,6 +215,10 @@ optional_policy(` ') optional_policy(` @@ -25,7 +25,7 @@ chrome_role_notrans(unconfined_r, unconfined_t) tunable_policy(`unconfined_chrome_sandbox_transition',` -@@ -248,6 +257,18 @@ optional_policy(` +@@ -244,6 +253,18 @@ optional_policy(` dbus_stub(unconfined_t) optional_policy(` ++++++ fix_unprivuser.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.683213649 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.683213649 +0200 @@ -1,8 +1,8 @@ -Index: fedora-policy-20221019/policy/modules/roles/unprivuser.te +Index: fedora-policy-20220624/policy/modules/roles/unprivuser.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/roles/unprivuser.te -+++ fedora-policy-20221019/policy/modules/roles/unprivuser.te -@@ -300,6 +300,13 @@ ifndef(`distro_redhat',` +--- fedora-policy-20220624.orig/policy/modules/roles/unprivuser.te ++++ fedora-policy-20220624/policy/modules/roles/unprivuser.te +@@ -296,6 +296,13 @@ ifndef(`distro_redhat',` ') optional_policy(` ++++++ fix_xserver.patch ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.703213690 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.707213699 +0200 @@ -1,7 +1,7 @@ -Index: fedora-policy-20221019/policy/modules/services/xserver.fc +Index: fedora-policy-20220714/policy/modules/services/xserver.fc =================================================================== ---- fedora-policy-20221019.orig/policy/modules/services/xserver.fc -+++ fedora-policy-20221019/policy/modules/services/xserver.fc +--- fedora-policy-20220714.orig/policy/modules/services/xserver.fc ++++ fedora-policy-20220714/policy/modules/services/xserver.fc @@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_ /etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0) @@ -51,13 +51,13 @@ /var/run/video.rom -- gen_context(system_u:object_r:xserver_var_run_t,s0) /var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0) -Index: fedora-policy-20221019/policy/modules/services/xserver.te +Index: fedora-policy-20220714/policy/modules/services/xserver.te =================================================================== ---- fedora-policy-20221019.orig/policy/modules/services/xserver.te -+++ fedora-policy-20221019/policy/modules/services/xserver.te -@@ -475,6 +475,10 @@ userdom_dontaudit_read_admin_home_lnk_fi - - kernel_read_vm_sysctls(xdm_t) +--- fedora-policy-20220714.orig/policy/modules/services/xserver.te ++++ fedora-policy-20220714/policy/modules/services/xserver.te +@@ -473,6 +473,10 @@ userdom_delete_user_home_content_files(x + userdom_signull_unpriv_users(xdm_t) + userdom_dontaudit_read_admin_home_lnk_files(xdm_t) +files_manage_generic_pids_symlinks(xdm_t) +userdom_manage_user_home_content_dirs(xdm_t) ++++++ modules-minimum-contrib.conf ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.767213822 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.771213830 +0200 @@ -342,6 +342,13 @@ # cobbler = module +# Layer: contrib +# Module: cockpit +# +# cockpit - Cockpit runs in a browser and can manage your network of GNU/Linux machines. +# +cockpit = module + # Layer: services # Module: collectd # @@ -2361,6 +2368,13 @@ freeipmi = module # Layer: contrib +# Module: freeipmi +# +# ipa policy module contain SELinux policies for IPA services +# +ipa = module + +# Layer: contrib # Module: mirrormanager # # mirrormanager policy ++++++ modules-targeted-contrib.conf ++++++ --- /var/tmp/diff_new_pack.MvsQip/_old 2022-10-24 11:13:13.863214020 +0200 +++ /var/tmp/diff_new_pack.MvsQip/_new 2022-10-24 11:13:13.867214028 +0200 @@ -342,6 +342,13 @@ # cobbler = module +# Layer: contrib +# Module: cockpit +# +# cockpit - Cockpit runs in a browser and can manage your network of GNU/Linux machines. +# +cockpit = module + # Layer: services # Module: collectd # @@ -2375,6 +2382,13 @@ freeipmi = module # Layer: contrib +# Module: freeipmi +# +# ipa policy module contain SELinux policies for IPA services +# +ipa = module + +# Layer: contrib # Module: mirrormanager # # mirrormanager policy