[yocto] [meta-selinux][PATCH 1/3] V2 refpolicy:20140311 update for systemd

[Joe MacDonald]

Hi Shrikant,

All three of these have been merged.  Thanks.  And my apologies to
everyone on the delay for these patches.

-J.

[Re: [yocto] [meta-selinux][PATCH 1/3] V2 refpolicy:20140311 update for systemd] On 15.01.05 (Mon 17:12) Shrikant Bobade wrote:

> Hello,
> 
> Please provide review comments or feedback if any, It will be a great help. 
> @Ping.
> 
> Thanks
> Shrikant
> 
> On Wed, Nov 19, 2014 at 1:43 PM, Shrikant Bobade <bobadeshrikant at gmail.com>
> wrote:
> 
>     From: Shrikant Bobade <Shrikant_Bobade at mentor.com>
> 
>     Systemd init type and related allow rules
>     updated for refpolicy.
> 
>     Signed-off-by: Shrikant Bobade <Shrikant_Bobade at mentor.com>
>     ---
>      .../refpolicy-update-for_systemd.patch             |   46
>     ++++++++++++++++++++
>      .../refpolicy/refpolicy_2.20140311.inc             |    1 +
>      2 files changed, 47 insertions(+)
>      create mode 100644 recipes-security/refpolicy/refpolicy-2.20140311/
>     refpolicy-update-for_systemd.patch
> 
>     diff --git a/recipes-security/refpolicy/refpolicy-2.20140311/
>     refpolicy-update-for_systemd.patch b/recipes-security/refpolicy/
>     refpolicy-2.20140311/refpolicy-update-for_systemd.patch
>     new file mode 100644
>     index 0000000..80b420c
>     --- /dev/null
>     +++ b/recipes-security/refpolicy/refpolicy-2.20140311/
>     refpolicy-update-for_systemd.patch
>     @@ -0,0 +1,46 @@
>     +refpolicy: update for systemd
>     +
>     +It provides the systemd support for refpolicy
>     +and related allow rules.
>     +The restorecon provides systemd init labeled
>     +as init_exec_t.
>     +
>     +Upstream-Status: Pending
>     +
>     +
>     +Signed-off-by: Shrikant Bobade <Shrikant_Bobade at mentor.com>
>     +
>     +--- a/policy/modules/contrib/shutdown.fc
>     ++++ b/policy/modules/contrib/shutdown.fc
>     +@@ -5,6 +5,9 @@
>     + /sbin/shutdown        --      gen_context
>     (system_u:object_r:shutdown_exec_t,s0)
>     + /sbin/shutdown\.sysvinit      --      gen_context
>     (system_u:object_r:shutdown_exec_t,s0)
>     +
>     ++# systemd support
>     ++/bin/systemctl        --      gen_context
>     (system_u:object_r:shutdown_exec_t,s0)
>     ++
>     + /usr/lib/upstart/shutdown     --      gen_context
>     (system_u:object_r:shutdown_exec_t,s0)
>     +
>     + /usr/sbin/shutdown    --      gen_context
>     (system_u:object_r:shutdown_exec_t,s0)
>     +--- a/policy/modules/system/init.fc
>     ++++ b/policy/modules/system/init.fc
>     +@@ -31,6 +31,8 @@
>     + #
>     + /sbin/init(ng)?               --      gen_context
>     (system_u:object_r:init_exec_t,s0)
>     + /sbin/init\.sysvinit  --      gen_context
>     (system_u:object_r:init_exec_t,s0)
>     ++# systemd support
>     ++/lib/systemd/systemd  --      gen_context
>     (system_u:object_r:init_exec_t,s0)
>     + # because nowadays, /sbin/init is often a symlink to /sbin/upstart
>     + /sbin/upstart         --      gen_context
>     (system_u:object_r:init_exec_t,s0)
>     +
>     +--- a/policy/modules/system/init.te
>     ++++ b/policy/modules/system/init.te
>     +@@ -913,3 +913,8 @@
>     + optional_policy(`
>     +       zebra_read_config(initrc_t)
>     + ')
>     ++
>     ++# systemd related allow rules
>     ++allow kernel_t init_t:process dyntransition;
>     ++allow devpts_t device_t:filesystem associate;
>     ++allow init_t self:capability2 block_suspend;
>     diff --git a/recipes-security/refpolicy/refpolicy_2.20140311.inc b/
>     recipes-security/refpolicy/refpolicy_2.20140311.inc
>     index 8894583..557b4ab 100644
>     --- a/recipes-security/refpolicy/refpolicy_2.20140311.inc
>     +++ b/recipes-security/refpolicy/refpolicy_2.20140311.inc
>     @@ -29,6 +29,7 @@ SRC_URI += "file://poky-fc-subs_dist.patch \
>                  file://poky-fc-rpm.patch \
>                  file://poky-fc-ftpwho-dir.patch \
>                  file://poky-fc-fix-real-path_su.patch \
>     +            file://refpolicy-update-for_systemd.patch \
>                 "
> 
>      # Specific policy for Poky
>     --
>     1.7.9.5
> 
> 
> 

-- 
-Joe MacDonald.
:wq
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: Digital signature
URL: <http://lists.yoctoproject.org/pipermail/yocto/attachments/20150112/be4740b0/attachment.pgp>