Russell Coker <russell@xxxxxxxxxxxx> writes:
> I think the old timesync labelling wasn't working anyway due to -- for a
> directory name.
>
> A couple of patches for devicekit calling dmidecode (this is part of replacing
> some kmem access that was discussed on this list and rejected as a misfeature
> in Debian DMI related code ages ago).
>
> The rest should be obvious.
>
> Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
> +++ refpolicy-2.20180701/policy/modules/services/ntp.fc
> @@ -32,7 +32,7 @@
> /var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
> /var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
> /var/lib/systemd/clock -- gen_context(system_u:object_r:ntp_drift_t,s0)
> -/var/lib/private/systemd/timesync(/.*)? -- gen_context(system_u:object_r:ntp_drift_t,s0)
> +/var/lib/systemd/timesync(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
Yes that and systemd-timesync no longer uses DynamicUser= and so
/var/lib/private no longer applies
Also refpolicy should consider making /var/{lib/private,cache/private,log/private} equivalent to
/var/lib, /var/cache and /var/log respectively
>
> /var/lock/ntpdate -- gen_context(system_u:object_r:ntpd_lock_t,s0)
>
> Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
> +++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
> @@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
> locallogin_use_fds(dmidecode_t)
>
> userdom_use_inherited_user_terminals(dmidecode_t)
> +
> +ifdef(`init_systemd',`
> + # inherits /dev/null and a socket from devicekit_disk_t
> + init_use_fds(dmidecode_t)
> + init_rw_inherited_stream_socket(dmidecode_t)
> +')
> Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
> +++ refpolicy-2.20180701/policy/modules/services/devicekit.te
> @@ -177,6 +177,10 @@ optional_policy(`
> ')
>
> optional_policy(`
> + dmidecode_domtrans(devicekit_disk_t)
> +')
> +
> +optional_policy(`
> fstools_domtrans(devicekit_disk_t)
> ')
>
> Index: refpolicy-2.20180701/policy/modules/services/xserver.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
> +++ refpolicy-2.20180701/policy/modules/services/xserver.te
> @@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)
>
> domain_use_interactive_fds(xauth_t)
>
> +dev_read_sysfs(xauth_t)
> +
> files_read_etc_files(xauth_t)
> files_search_pids(xauth_t)
>
> Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
> +++ refpolicy-2.20180701/policy/modules/system/unconfined.te
> @@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
> ')
>
> ifdef(`init_systemd',`
> + # for systemd-analyze
> + init_service_status(unconfined_t)
> +
> optional_policy(`
> systemd_dbus_chat_resolved(unconfined_t)
> ')
--
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift
