开源软件构建与测试

_service:tar_scm:selinux-policy.spec Changed

@@ -6,17 +6,17 @@
 %define BUILD_MINIMUM 1
 %define BUILD_MLS 1
 %define POLICYVER 33
-%define POLICYCOREUTILSVER 3.2
+%define POLICYCOREUTILSVER 3.4
 %define CHECKPOLICYVER 3.2
 
 Summary: SELinux policy configuration
 Name:    selinux-policy
-Version: 35.5
-Release: 6
+Version: 38.6
+Release: 4
 License: GPLv2+
 URL:     https://github.com/fedora-selinux/selinux-policy/
 
-Source0: https://github.com/fedora-selinux/selinux-policy/archive/02b35cff10d8743e075379c062f565f2bb97c032/selinux-policy-02b35cf.tar.gz
+Source0: https://github.com/fedora-selinux/selinux-policy/archive/refs/tags/v38.6.tar.gz
 
 # Tool helps during policy development, to expand system m4 macros to raw allow rules
 # Git repo: https://github.com/fedora-selinux/macro-expander.git
@@ -59,23 +59,29 @@
 Patch4:  add_userman_access_run_dir.patch
 Patch5:  add-firewalld-fc.patch
 Patch6:  add-allow-systemd-timedated-to-unlink-etc-link.patch
-Patch7:  add-avc-for-openEuler-1.patch
+Patch7:  add-avc-for-os-1.patch
 Patch8:  allow-rpcbind-to-bind-all-port.patch
 Patch9:  add-avc-for-systemd-journald.patch
 Patch10: add-avc-for-systemd.patch
-
-Patch6000: backport-Allow-domain-transition-to-sssd_t-and-role-access-to.patch
+Patch11: Allow-login_pgm-setcap-permission.patch
 
 Patch9000: add-qemu_exec_t-for-stratovirt.patch
 Patch9001: fix-context-of-usr-bin-rpmdb.patch
 Patch9002: Add-permission-open-to-files_read_inherited_tmp_file.patch
 Patch9003: allow-httpd-to-put-files-in-httpd-config-dir.patch
+Patch9004: allow-map-postfix_master_t.patch
+Patch9005: add-rule-for-hostnamed-to-rpmscript-dbus-chat.patch
+Patch9006: allow-init_t-create-fifo-file-in-net_conf-dir.patch 
+Patch9007: Revert-Don-t-allow-kernel_t-to-execute-bin_t-usr_t-binaries.patch
+Patch9008: Policy-for-restoring-kernel_t.patch
 
 BuildArch: noarch
-BuildRequires:  python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc
+BuildRequires:  python3 gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-devel >= %{POLICYCOREUTILSVER} bzip2 gcc procps-ng
 Requires(pre):  policycoreutils >= %{POLICYCOREUTILSVER}
 Requires(post): /bin/awk /usr/bin/sha512sum
 Requires: rpm-plugin-selinux
+Requires: selinux-policy-any = %{version}-%{release}
+Provides: selinux-policy-base = %{version}-%{release}
 Suggests: selinux-policy-targeted
 
 %description 
@@ -183,6 +189,7 @@
 %ghost %{_sharedstatedir}/selinux/%1/active/seusers.linked \
 %ghost %{_sharedstatedir}/selinux/%1/active/users_extra.linked \
 %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/file_contexts.homedirs \
+%verify(not md5 size mtime) %{_sharedstatedir}/selinux/%1/active/modules_checksum \
 %nil
 
 %define relabel() \
@@ -294,7 +301,7 @@
 %build
 
 %prep 
-%setup -n %{name}-02b35cff10d8743e075379c062f565f2bb97c032 -q
+%setup -n %{name}-%{version} -q
 tar -C policy/modules/contrib -xf %{SOURCE35}
 
 %autopatch -p1
@@ -447,6 +454,7 @@
 
 %package devel
 Summary: SELinux policy devel
+Requires(pre): selinux-policy = %{version}-%{release}
 Requires: selinux-policy = %{version}-%{release} m4 checkpolicy >= %{CHECKPOLICYVER} /usr/bin/make
 Requires(post): policycoreutils-devel >= %{POLICYCOREUTILSVER}
 
@@ -487,7 +495,7 @@
 Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} coreutils selinux-policy = %{version}-%{release}
 Requires:  selinux-policy = %{version}-%{release}
 
-Provides:  selinux-policy-base = %{version}-%{release}
+Provides: selinux-policy-any = %{version}-%{release}
 Obsoletes: selinux-policy-targeted-sources < 2
 Obsoletes: mod_fcgid-selinux <= %{version}-%{release}
 Obsoletes: cachefilesd-selinux <= 0.10-1
@@ -572,7 +580,7 @@
 Requires(post): policycoreutils-python-utils >= %{POLICYCOREUTILSVER}
 Requires: selinux-policy = %{version}-%{release}
 
-Provides:  selinux-policy-base = %{version}-%{release}
+Provides: selinux-policy-any = %{version}-%{release}
 Conflicts: seedit
 Conflicts: container-selinux <= 1.9.0-9
 
@@ -671,9 +679,9 @@
 %package mls 
 Summary: SELinux mls base policy
 Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd selinux-policy = %{version}-%{release}
-Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} coreutils
+Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} coreutils selinux-policy = %{version}-%{release}
 
-Provides:  selinux-policy-base = %{version}-%{release}
+Provides: selinux-policy-any = %{version}-%{release}
 Obsoletes: selinux-policy-mls-sources < 2
 Conflicts: seedit
 Conflicts: container-selinux <= 1.9.0-9
@@ -735,6 +743,51 @@
 %endif
 
 %changelog
+* Wed Mar 29 2023 luhuaxin<luhuaxin1@huawei.com> - 38.6-4
+- allow login_pgm setcap permission
+
+* Mon Mar 20 2023 jinlun<jinlun@huawei.com> - 38.6-3
+- Don't allow kernel_t to execute bin_t/usr_t binaries without a transition
+
+* Mon Feb 6 2023 luhuaxin<luhuaxin1@huawei.com> - 38.6-2
+- allow init_t create fifo file in net_conf dir
+
+* Wed Feb 1 2023 zhangguangzhi<zhangguangzhi3@huawei.com> - 38.6-1
+- update version to 38.6
+
+* Thu Dec 29 2022 lixiao<lixiaoemail2017@163.com> - 35.5-17
+- add rule for hostnamed to rpmscript dbus chat
+
+* Sat Dec 24 2022 lixiao<lixiaoemail2017@163.com> - 35.5-16
+- add the dependency between packages
+
+* Sun Dec 3 2022 lujie <lujie54@huawei.com> - 35.5-15
+- modify the patch name for the problem of vendor hard code
+
+* Sun Nov 27 2022 lujie <lujie54@huawei.com> - 35.5-14
+- backport upstream patches
+
+* Mon Sep 19 2022 xinghe <xinghe2@h-partners.com> - 35.5-13
+- allow map postfix_master_t
+
+* Thu Sep 15 2022 lujie <lujie54@huawei.com> - 35.5-12
+- backport upstream patches
+
+* Tue Sep 13 2022 lujie <lujie54@huawei.com> - 35.5-11
+- backport upstream patches
+
+* Tue Sep 13 2022 lujie <lujie54@huawei.com> - 35.5-10
+- backport upstream patches
+
+* Tue Sep 13 2022 lujie <lujie54@huawei.com> - 35.5-9
+- backport upstream patches
+
+* Fri Sep 2 2022 lujie <lujie54@huawei.com> - 35.5-8
+- backport upstream patches
+
+* Thu Aug 18 2022 xuwenlong <xuwenlong16@huawei.com> - 35.5-7
+- Allow chage domtrans to sssd
+
 * Mon Jun 27 2022 lujie <lujie54@huawei.com> - 35.5-6
 - Allow domain transition to sssd_t and role access to sssd

_service:tar_scm:Allow-login_pgm-setcap-permission.patch Added

@@ -0,0 +1,42 @@
+From 704e79751a2219a7a1e647084be6dbf04e679bf6 Mon Sep 17 00:00:00 2001
+From: Zdenek Pytela <zpytela@redhat.com>
+Date: Fri, 3 Mar 2023 12:22:12 +0100
+Subject: PATCH Allow login_pgm setcap permission
+
+There is a pam_cap module as a part of the libcap package. When a
+capability is added to the login process using pam_cap, the setcap
+permission is required.
+
+Example setup:
+
+ echo "cap_dac_read_search exampleuser" > /etc/security/capability.conf
+ echo "auth required pam_cap.so" >> /etc/pam.d/postlogin
+
+Addresses the following AVC denial:
+
+type=PROCTITLE msg=audit(03/03/2023 06:30:19.302:505) : proctitle=sshd: exampleuser priv
+type=SYSCALL msg=audit(03/03/2023 06:30:19.302:505) : arch=x86_64 syscall=capset success=no exit=EACCES(Permission denied) a0=0x55b8338dc6f4 a1=0x55b8338dc6fc a2=0x55b8338dc6fc a3=0x55b83388d010 items=0 ppid=1350 pid=1357 auid=exampleuser uid=root gid=exampleuser euid=root suid=root fsuid=root egid=exampleuser sgid=exampleuser fsgid=exampleuser tty=(none) ses=7 comm=sshd exe=/usr/sbin/sshd subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
+type=AVC msg=audit(03/03/2023 06:30:19.302:505) : avc:  denied  { setcap } for  pid=1357 comm=sshd scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=process permissive=0
+
+Resolves: rhbz#2172541
+Signed-off-by: Huaxin Lu <luhuaxin1@huawei.com>
+---
+ policy/modules/system/authlogin.te | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
+index feabf67ab..2c3628a31 100644
+--- a/policy/modules/system/authlogin.te
++++ b/policy/modules/system/authlogin.te
+@@ -593,7 +593,7 @@ allow login_pgm self:netlink_kobject_uevent_socket create_socket_perms;
+ allow login_pgm self:netlink_selinux_socket create_socket_perms; 
+ allow login_pgm self:capability ipc_lock;
+ dontaudit login_pgm self:capability net_admin;
+-allow login_pgm self:process setkeycreate;
++allow login_pgm self:process { setcap setkeycreate };
+ allow login_pgm self:key manage_key_perms;
+ userdom_manage_all_users_keys(login_pgm)
+ allow login_pgm nsswitch_domain:key manage_key_perms;
+-- 
+2.33.0
+

_service:tar_scm:Policy-for-restoring-kernel_t.patch Added

_service:tar_scm:Revert-Don-t-allow-kernel_t-to-execute-bin_t-usr_t-binaries.patch Added

@@ -0,0 +1,37 @@
+From 36a7559c14a33b8ae867acaf3a724529ef2aa7ea Mon Sep 17 00:00:00 2001
+From: "GONG, Ruiqi" <gongruiqi1@huawei.com>
+Date: Mon, 20 Mar 2023 20:42:49 +0800
+Subject: PATCH Revert "Don't allow kernel_t to execute bin_t/usr_t binaries
+ without a transition"
+
+This reverts commit 18c5559222ea3ca3588c8d32c06cddc41b66f688.
+---
+ policy/modules/kernel/kernel.te | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
+index f7ac8cd1f..2df33b0ac 100644
+--- a/policy/modules/kernel/kernel.te
++++ b/policy/modules/kernel/kernel.te
+@@ -347,16 +347,10 @@ selinux_compute_create_context(kernel_t)
+ term_use_all_terms(kernel_t)
+ term_use_ptmx(kernel_t)
+ 
++corecmd_exec_shell(kernel_t)
+ corecmd_list_bin(kernel_t)
+-
+-# /proc/sys/kernel/modprobe is set to /bin/true if not using modules,
+-# thus allow a transition into a minimal helper domain through generic bin
+-# types.
+-type kernel_generic_helper_t;
+-domain_type(kernel_generic_helper_t)
+-role system_r types kernel_generic_helper_t;
+-corecmd_bin_entry_type(kernel_generic_helper_t)
+-corecmd_bin_domtrans(kernel_t, kernel_generic_helper_t)
++# /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
++corecmd_exec_bin(kernel_t)
+ 
+ domain_use_all_fds(kernel_t)
+ domain_signal_all_domains(kernel_t)
+-- 
+2.25.1

_service:tar_scm:add-avc-for-openEuler-1.patch Deleted

@@ -1,63 +0,0 @@
-From 076002627934ea3f9ec59de1dde25a840bd1a452 Mon Sep 17 00:00:00 2001
-From: HuaxinLuGitee <1539327763@qq.com>
-Date: Sun, 13 Dec 2020 14:48:26 +0800
-Subject: PATCH add-avc-for-openEuler-1
-
----
- policy/modules/contrib/firewalld.te | 2 ++
- policy/modules/contrib/logrotate.te | 4 +++-
- policy/modules/system/init.te       | 1 +
- 3 files changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/policy/modules/contrib/firewalld.te b/policy/modules/contrib/firewalld.te
-index d23045d..d8c5f25 100644
---- a/policy/modules/contrib/firewalld.te
-+++ b/policy/modules/contrib/firewalld.te
-@@ -107,6 +107,8 @@ sysnet_relabelto_net_conf(firewalld_t)
- userdom_dontaudit_create_admin_dir(firewalld_t)
- userdom_dontaudit_manage_admin_dir(firewalld_t)
- 
-+files_rw_var_lib_dirs(firewalld_t)
-+
- optional_policy(`
- 	dbus_system_domain(firewalld_t, firewalld_exec_t)
- 
-diff --git a/policy/modules/contrib/logrotate.te b/policy/modules/contrib/logrotate.te
-index 98019eb..559c079 100644
---- a/policy/modules/contrib/logrotate.te
-+++ b/policy/modules/contrib/logrotate.te
-@@ -145,6 +145,7 @@ files_manage_generic_spool(logrotate_t)
- files_manage_generic_spool_dirs(logrotate_t)
- files_getattr_generic_locks(logrotate_t)
- files_dontaudit_list_mnt(logrotate_t)
-+files_list_var(logrotate_t)
- 
- fs_search_auto_mountpoints(logrotate_t)
- fs_getattr_xattr_fs(logrotate_t)
-@@ -239,9 +240,10 @@ optional_policy(`
- 
- optional_policy(`
- 	apache_read_config(logrotate_t)
--    apache_read_sys_content_rw_dirs(logrotate_t)
-+	apache_read_sys_content_rw_dirs(logrotate_t)
- 	apache_domtrans(logrotate_t)
- 	apache_signull(logrotate_t)
-+	apache_read_sys_content(logrotate_t)
- ')
- 
- optional_policy(`
-diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index d8ca280..0bc90bf 100644
---- a/policy/modules/system/init.te
-+++ b/policy/modules/system/init.te
-@@ -597,6 +597,7 @@ files_mounton_kernel_symbol_table(init_t)
- files_manage_all_pid_dirs(init_t)
- files_write_all_pid_sockets(init_t)
- files_manage_etc_dirs(init_t)
-+files_rw_etc_files(init_t)
- files_manage_generic_tmp_dirs(init_t)
- files_relabel_all_pid_dirs(init_t)
- files_relabel_all_pid_files(init_t)
--- 
-1.8.3.1
-

_service:tar_scm:add-avc-for-os-1.patch Added

@@ -0,0 +1,63 @@
+From 076002627934ea3f9ec59de1dde25a840bd1a452 Mon Sep 17 00:00:00 2001
+From: HuaxinLuGitee <1539327763@qq.com>
+Date: Sun, 13 Dec 2020 14:48:26 +0800
+Subject: PATCH add-avc-for-os-1
+
+---
+ policy/modules/contrib/firewalld.te | 2 ++
+ policy/modules/contrib/logrotate.te | 4 +++-
+ policy/modules/system/init.te       | 1 +
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/policy/modules/contrib/firewalld.te b/policy/modules/contrib/firewalld.te
+index d23045d..d8c5f25 100644
+--- a/policy/modules/contrib/firewalld.te
++++ b/policy/modules/contrib/firewalld.te
+@@ -107,6 +107,8 @@ sysnet_relabelto_net_conf(firewalld_t)
+ userdom_dontaudit_create_admin_dir(firewalld_t)
+ userdom_dontaudit_manage_admin_dir(firewalld_t)
+ 
++files_rw_var_lib_dirs(firewalld_t)
++
+ optional_policy(`
+ 	dbus_system_domain(firewalld_t, firewalld_exec_t)
+ 
+diff --git a/policy/modules/contrib/logrotate.te b/policy/modules/contrib/logrotate.te
+index 98019eb..559c079 100644
+--- a/policy/modules/contrib/logrotate.te
++++ b/policy/modules/contrib/logrotate.te
+@@ -145,6 +145,7 @@ files_manage_generic_spool(logrotate_t)
+ files_manage_generic_spool_dirs(logrotate_t)
+ files_getattr_generic_locks(logrotate_t)
+ files_dontaudit_list_mnt(logrotate_t)
++files_list_var(logrotate_t)
+ 
+ fs_search_auto_mountpoints(logrotate_t)
+ fs_getattr_xattr_fs(logrotate_t)
+@@ -239,9 +240,10 @@ optional_policy(`
+ 
+ optional_policy(`
+ 	apache_read_config(logrotate_t)
+-    apache_read_sys_content_rw_dirs(logrotate_t)
++	apache_read_sys_content_rw_dirs(logrotate_t)
+ 	apache_domtrans(logrotate_t)
+ 	apache_signull(logrotate_t)
++	apache_read_sys_content(logrotate_t)
+ ')
+ 
+ optional_policy(`
+diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
+index d8ca280..0bc90bf 100644
+--- a/policy/modules/system/init.te
++++ b/policy/modules/system/init.te
+@@ -597,6 +597,7 @@ files_mounton_kernel_symbol_table(init_t)
+ files_manage_all_pid_dirs(init_t)
+ files_write_all_pid_sockets(init_t)
+ files_manage_etc_dirs(init_t)
++files_rw_etc_files(init_t)
+ files_manage_generic_tmp_dirs(init_t)
+ files_relabel_all_pid_dirs(init_t)
+ files_relabel_all_pid_files(init_t)
+-- 
+1.8.3.1
+

_service:tar_scm:add-rule-for-hostnamed-to-rpmscript-dbus-chat.patch Added

_service:tar_scm:allow-init_t-create-fifo-file-in-net_conf-dir.patch Added

_service:tar_scm:allow-map-postfix_master_t.patch Added

_service:tar_scm:backport-Allow-domain-transition-to-sssd_t-and-role-access-to.patch Deleted

@@ -1,172 +0,0 @@
-From 6956435a4e3cc5a6f0d311f80b31abddd83d9ae5 Mon Sep 17 00:00:00 2001
-From:  Patrik Koncity <pkoncity@redhat.com>
-Date: Mon, 27 Jun 2022 20:37:44 +0800
-Subject: PATCH Allow domain transition to sssd_t and role access to sssd
-
-When installing some rpm packages, new users or
-groups are added to the system using
-the groupadd and useradd tools. Then the sss_cache
-file with the bin_t label is run and on this file
-groupadd and useradd want to setgid and this
-trigger SELinux denials. Label the sss_cache binary
-as sssd_exec_t and enabling the transition from
-groupadd_t and useradd_t to sssd_t. Sssd policy
-allowed setgid on this binary.
-
-Reference:https://github.com/fedora-selinux/selinux-policy/commit/bcc321f1719d252b205edf89f82f578c1c309eb0
-Conflict: NA
-
-After previous fix in bugzilla arise a SELinux
-error with role. Processes running under
-unconfined_r do not have access to sssd_t.
-Allow domain transition from rpm_script_t to
-sssd_t and allow the rpm_script_roles in the
-sssd domain.
-
-Reference:https://github.com/fedora-selinux/selinux-policy/commit/25bdcfdf5821ddba2c47fc4306bc43debc4c0f75
-Conflict: NA
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2022690
-
-
-sssd_run_sssd interface allow execute sssd in the
-sssd domain, and allow the specified role
-the sssd domain.
-
-Reference:https://github.com/fedora-selinux/selinux-policy/commit/d7ef9cf83cb50b4349cb8277c2cd126c17dc629a
-Conflict: NA
-
-Signed-off-by: lujie54 <lujie54@huawei.com>
----
- policy/modules/admin/usermanage.te | 18 ++++++++++--------
- policy/modules/contrib/rpm.te      |  4 ++++
- policy/modules/contrib/sssd.fc     |  1 +
- policy/modules/contrib/sssd.if     | 27 +++++++++++++++++++++++++++
- policy/modules/contrib/sssd.te     |  3 +++
- 5 files changed, 45 insertions(+), 8 deletions(-)
-
-diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
-index 5a857e0..b945e3c 100644
---- a/policy/modules/admin/usermanage.te
-+++ b/policy/modules/admin/usermanage.te
-@@ -300,10 +300,11 @@ optional_policy(`
- ')
- 
- optional_policy(`
--    sssd_manage_lib_files(groupadd_t)
--    sssd_manage_public_files(groupadd_t)
--    sssd_read_pid_files(groupadd_t)
--    sssd_signal(groupadd_t)
-+	sssd_domtrans(groupadd_t)
-+	sssd_manage_lib_files(groupadd_t)
-+	sssd_manage_public_files(groupadd_t)
-+	sssd_read_pid_files(groupadd_t)
-+	sssd_signal(groupadd_t)
- ')
- 
- optional_policy(`
-@@ -679,10 +680,11 @@ optional_policy(`
- ')
- 
- optional_policy(`
--    sssd_manage_lib_files(useradd_t)
--    sssd_manage_public_files(useradd_t)
--    sssd_read_pid_files(useradd_t)
--    sssd_signal(useradd_t)
-+	sssd_domtrans(useradd_t)
-+    	sssd_manage_lib_files(useradd_t)
-+    	sssd_manage_public_files(useradd_t)
-+    	sssd_read_pid_files(useradd_t)
-+    	sssd_signal(useradd_t)
- ')
- 
- optional_policy(`
-diff --git a/policy/modules/contrib/rpm.te b/policy/modules/contrib/rpm.te
-index 9d2f4e6..3f6de12 100644
---- a/policy/modules/contrib/rpm.te
-+++ b/policy/modules/contrib/rpm.te
-@@ -481,6 +481,10 @@ optional_policy(`
- ')
- 
- optional_policy(`
-+	sssd_run_sssd(rpm_script_t, rpm_script_roles)
-+')
-+
-+optional_policy(`
- 	tzdata_domtrans(rpm_t)
- 	tzdata_run(rpm_script_t, rpm_script_roles)
- ')
-diff --git a/policy/modules/contrib/sssd.fc b/policy/modules/contrib/sssd.fc
-index 2655c75..f51950d 100644
---- a/policy/modules/contrib/sssd.fc
-+++ b/policy/modules/contrib/sssd.fc
-@@ -3,6 +3,7 @@
- /etc/sssd(/.*)?			gen_context(system_u:object_r:sssd_conf_t,s0)
- 
- /usr/sbin/sssd		--	gen_context(system_u:object_r:sssd_exec_t,s0)
-+/usr/sbin/sss_cache		--	gen_context(system_u:object_r:sssd_exec_t,s0)
- /usr/libexec/sssd/sssd_autofs	--	gen_context(system_u:object_r:sssd_exec_t,s0)
- /usr/libexec/sssd/sssd_ifp	--	gen_context(system_u:object_r:sssd_exec_t,s0)
- /usr/libexec/sssd/sssd_nss	--	gen_context(system_u:object_r:sssd_exec_t,s0)
-diff --git a/policy/modules/contrib/sssd.if b/policy/modules/contrib/sssd.if
-index e1ff0d7..6debe08 100644
---- a/policy/modules/contrib/sssd.if
-+++ b/policy/modules/contrib/sssd.if
-@@ -429,6 +429,33 @@ interface(`sssd_dontaudit_stream_connect',`
- 
- ########################################
- ## <summary>
-+##	Execute sssd in the sssd domain, and
-+##	allow the specified role the sssd domain.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed to transition.
-+##	</summary>
-+## </param>
-+## <param name="role">
-+##	<summary>
-+##	Role allowed access.
-+##	</summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`sssd_run_sssd',`
-+	gen_require(`
-+		type sssd_t;
-+		attribute_role sssd_roles;
-+	')
-+
-+	sssd_domtrans($1)
-+	roleattribute $2 sssd_roles;
-+')
-+
-+########################################
-+## <summary>
- ##	Connect to sssd over a unix stream socket in /var/run.
- ## </summary>
- ## <param name="domain">
-diff --git a/policy/modules/contrib/sssd.te b/policy/modules/contrib/sssd.te
-index b510dca..f64472c 100644
---- a/policy/modules/contrib/sssd.te
-+++ b/policy/modules/contrib/sssd.te
-@@ -5,6 +5,8 @@ policy_module(sssd, 1.2.0)
- # Declarations
- #
- 
-+attribute_role sssd_roles;
-+
- ## <desc>
- ##	<p>
- ##	Allow sssd read, view, and write access to kernel keys with kernel_t type
-@@ -22,6 +24,7 @@ gen_tunable(sssd_connect_all_unreserved_ports, false)
- type sssd_t;
- type sssd_exec_t;
- init_daemon_domain(sssd_t, sssd_exec_t)
-+role sssd_roles types sssd_t;
- 
- type sssd_initrc_exec_t;
- init_script_file(sssd_initrc_exec_t)
--- 
-1.8.3.1
-

_service Changed

_service:tar_scm:modules-targeted-contrib.conf Changed

_service:tar_scm:selinux-policy-02b35cf.tar.gz Deleted

_service:tar_scm:users-minimum Changed

_service:tar_scm:users-mls Changed

_service:tar_scm:users-targeted Changed

_service:tar_scm:v38.6.tar.gz Added

Changes of Revision 2