From 47068c8c1e3eb15908d925bed91a3cfd88ce01e2 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Fri, 4 Jan 2019 00:32:08 +0100 Subject: [PATCH 01/80] * Fri Jan 04 2019 Lukas Vrabec - 0.1.2-0 - Fix invalid syntax output when policy is using just one template Resolves: #6 --- .gitignore | 1 + sources | 2 +- udica.spec | 8 ++++++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 994fdc2..c4d48d3 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /v0.1.1.tar.gz +/v0.1.2.tar.gz diff --git a/sources b/sources index 7297920..16da401 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.1.tar.gz) = abf4bdd0e9d84fd5233f1f10494c11c40ef03dcb820c545d7ef0f003bd9e72b6dc60715f56296ec59380a6d9327cf255d50edd3bd23a30e700c322d134302f2a +SHA512 (v0.1.2.tar.gz) = c82741d9a8c92759e53deed117f8eabbe95d667192671a46f1ea3354037d8019993fba1c931f5d4a8554c2f5848cf652ee5d8d96056d15a0f4660082fd7651e0 diff --git a/udica.spec b/udica.spec index f1b15f8..dca70b9 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.1 -Release: 2%{?dist} +Version: 0.1.2 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Jan 04 2019 Lukas Vrabec - 0.1.2-1 +- Fix invalid syntax output when policy is using just one template +Resolves: #6 + * Tue Oct 23 2018 Lukas Vrabec - 0.1.1-2 - Fix small issues in spec file like improve description and change files section. From f56f9d634937c3de938c57729925eefd17f3e785 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Fri, 4 Jan 2019 21:26:01 +0100 Subject: [PATCH 02/80] * Fri Jan 04 2019 Lukas Vrabec - 0.1.2-1 - Fix invalid syntax output when policy is using just one template Resolves: #6 --- .gitignore | 1 + sources | 2 +- udica.spec | 8 ++++++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 994fdc2..c4d48d3 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /v0.1.1.tar.gz +/v0.1.2.tar.gz diff --git a/sources b/sources index 7297920..16da401 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.1.tar.gz) = abf4bdd0e9d84fd5233f1f10494c11c40ef03dcb820c545d7ef0f003bd9e72b6dc60715f56296ec59380a6d9327cf255d50edd3bd23a30e700c322d134302f2a +SHA512 (v0.1.2.tar.gz) = c82741d9a8c92759e53deed117f8eabbe95d667192671a46f1ea3354037d8019993fba1c931f5d4a8554c2f5848cf652ee5d8d96056d15a0f4660082fd7651e0 diff --git a/udica.spec b/udica.spec index f1b15f8..0a90de6 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.1 -Release: 2%{?dist} +Version: 0.1.2 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Jan 04 2019 Lukas Vrabec - 0.1.2-0 +- Fix invalid syntax output when policy is using just one template +Resolves: #6 + * Tue Oct 23 2018 Lukas Vrabec - 0.1.1-2 - Fix small issues in spec file like improve description and change files section. From c30c47700995f3276fd5dd29787b1ecf30f125ff Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 23 Jan 2019 17:13:07 +0100 Subject: [PATCH 03/80] * Wed Jan 23 2019 Lukas Vrabec - 0.1.3-1 - Fix capability allow rules when capabilities are specified in JSON file - Add additional SELinux allow rules to base container template to allow container to read proc_type types. --- .gitignore | 1 + sources | 2 +- udica.spec | 6 +++++- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index c4d48d3..a5b182f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /v0.1.1.tar.gz /v0.1.2.tar.gz +/v0.1.3.tar.gz diff --git a/sources b/sources index 16da401..c129a51 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.2.tar.gz) = c82741d9a8c92759e53deed117f8eabbe95d667192671a46f1ea3354037d8019993fba1c931f5d4a8554c2f5848cf652ee5d8d96056d15a0f4660082fd7651e0 +SHA512 (v0.1.3.tar.gz) = af25b74b5b7973ec1ae64a2a9ae6e2311a960ee9fe5c86af92488f69795189f999a17058e2c9677f97ea8348a8fa7525739af107e3a4ec7c0593587ec849b5a9 diff --git a/udica.spec b/udica.spec index dca70b9..443c642 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.2 +Version: 0.1.3 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -58,6 +58,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Jan 23 2019 Lukas Vrabec - 0.1.3-1 +- Fix capability allow rules when capabilities are specified in JSON file +- Add additional SELinux allow rules to base container template to allow container to read proc_type types. + * Fri Jan 04 2019 Lukas Vrabec - 0.1.2-1 - Fix invalid syntax output when policy is using just one template Resolves: #6 From 701bcf5cfad48fb1e32b61b8fb03328d7e3e3877 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 23 Jan 2019 17:46:32 +0100 Subject: [PATCH 04/80] * Wed Jan 23 2019 Lukas Vrabec - 0.1.3-1 - Fix capability allow rules when capabilities are specified in JSON file - Add additional SELinux allow rules to base container template to allow container to read proc_type types. --- udica.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 0a90de6..11c78d4 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.2 +Version: 0.1.3 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -58,6 +58,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Jan 23 2019 Lukas Vrabec - 0.1.3-1 +- Fix capability allow rules when capabilities are specified in JSON file +- Add additional SELinux allow rules to base container template to allow container to read proc_type types. + * Fri Jan 04 2019 Lukas Vrabec - 0.1.2-0 - Fix invalid syntax output when policy is using just one template Resolves: #6 From 948fe60e8a401a997e422280c97a882730d3f4a6 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 23 Jan 2019 17:52:35 +0100 Subject: [PATCH 05/80] Add news sources --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index c4d48d3..a5b182f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /v0.1.1.tar.gz /v0.1.2.tar.gz +/v0.1.3.tar.gz diff --git a/sources b/sources index 16da401..c129a51 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.2.tar.gz) = c82741d9a8c92759e53deed117f8eabbe95d667192671a46f1ea3354037d8019993fba1c931f5d4a8554c2f5848cf652ee5d8d96056d15a0f4660082fd7651e0 +SHA512 (v0.1.3.tar.gz) = af25b74b5b7973ec1ae64a2a9ae6e2311a960ee9fe5c86af92488f69795189f999a17058e2c9677f97ea8348a8fa7525739af107e3a4ec7c0593587ec849b5a9 From 979ba3e19520aec4aa4cde4fad43b548c5bd6716 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 3 Feb 2019 10:40:11 +0000 Subject: [PATCH 06/80] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 443c642..74cae76 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.1.3 -Release: 1%{?dist} +Release: 2%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sun Feb 03 2019 Fedora Release Engineering - 0.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Wed Jan 23 2019 Lukas Vrabec - 0.1.3-1 - Fix capability allow rules when capabilities are specified in JSON file - Add additional SELinux allow rules to base container template to allow container to read proc_type types. From d575e66328e5072235dd5ff14d5ff5c106874829 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Sun, 17 Feb 2019 22:59:23 +0100 Subject: [PATCH 07/80] * Sun Feb 17 2019 Lukas Vrabec - 0.1.3-3 - Improve capability parsing for docker containers - Update small changes in manpage, like issue with mandatory option '-c' for docker containers - Fix parsing Mountpoints in docker inspect JSON file --- sources | 2 +- udica.spec | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/sources b/sources index c129a51..cbd8a1c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.3.tar.gz) = af25b74b5b7973ec1ae64a2a9ae6e2311a960ee9fe5c86af92488f69795189f999a17058e2c9677f97ea8348a8fa7525739af107e3a4ec7c0593587ec849b5a9 +SHA512 (v0.1.3.tar.gz) = c0ef057f30ae4475c08d5a2972110b3608d535dd02ecb4c8aaeef676cf0510c28410063573613487e3a647f5a4c507b6eb831edaf3ab3c5de06b1fda62e2b603 diff --git a/udica.spec b/udica.spec index 74cae76..fec2d6d 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.1.3 -Release: 2%{?dist} +Release: 3%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,11 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sun Feb 17 2019 Lukas Vrabec - 0.1.3-3 +- Improve capability parsing for docker containers +- Update small changes in manpage, like issue with mandatory option '-c' for docker containers +- Fix parsing Mountpoints in docker inspect JSON file + * Sun Feb 03 2019 Fedora Release Engineering - 0.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 98555965c4146c6e6b2f8d6497e433d2f0d6909f Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Sun, 17 Feb 2019 22:59:23 +0100 Subject: [PATCH 08/80] * Sun Feb 17 2019 Lukas Vrabec - 0.1.3-2 - Improve capability parsing for docker containers - Update small changes in manpage, like issue with mandatory option '-c' for docker containers - Fix parsing Mountpoints in docker inspect JSON file --- sources | 2 +- udica.spec | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/sources b/sources index c129a51..cbd8a1c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.3.tar.gz) = af25b74b5b7973ec1ae64a2a9ae6e2311a960ee9fe5c86af92488f69795189f999a17058e2c9677f97ea8348a8fa7525739af107e3a4ec7c0593587ec849b5a9 +SHA512 (v0.1.3.tar.gz) = c0ef057f30ae4475c08d5a2972110b3608d535dd02ecb4c8aaeef676cf0510c28410063573613487e3a647f5a4c507b6eb831edaf3ab3c5de06b1fda62e2b603 diff --git a/udica.spec b/udica.spec index 11c78d4..069b57f 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.1.3 -Release: 1%{?dist} +Release: 2%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,11 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sun Feb 17 2019 Lukas Vrabec - 0.1.3-2 +- Improve capability parsing for docker containers +- Update small changes in manpage, like issue with mandatory option '-c' for docker containers +- Fix parsing Mountpoints in docker inspect JSON file + * Wed Jan 23 2019 Lukas Vrabec - 0.1.3-1 - Fix capability allow rules when capabilities are specified in JSON file - Add additional SELinux allow rules to base container template to allow container to read proc_type types. From 3cee827b9e34d6092da3537e46d92166cdb2c97f Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Mon, 25 Feb 2019 23:08:35 +0100 Subject: [PATCH 09/80] * Mon Feb 25 2019 Lukas Vrabec - 0.1.3-4 - Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8 - Add check if runtimes are installed on the system --- sources | 2 +- udica.spec | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/sources b/sources index cbd8a1c..25beb93 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.3.tar.gz) = c0ef057f30ae4475c08d5a2972110b3608d535dd02ecb4c8aaeef676cf0510c28410063573613487e3a647f5a4c507b6eb831edaf3ab3c5de06b1fda62e2b603 +SHA512 (v0.1.3.tar.gz) = a9063c940e61a58f779a809c0a3b76841ffafe3f47c101ed8d8cd5abfbd81cfc7e00b0867ddaa9004cb6d99176f1d061f7ade744125b5030e006a9cd7aa9e5b3 diff --git a/udica.spec b/udica.spec index fec2d6d..0474261 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.1.3 -Release: 3%{?dist} +Release: 4%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Feb 25 2019 Lukas Vrabec - 0.1.3-4 +- Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8 +- Add check if runtimes are installed on the system + * Sun Feb 17 2019 Lukas Vrabec - 0.1.3-3 - Improve capability parsing for docker containers - Update small changes in manpage, like issue with mandatory option '-c' for docker containers From 9c4d11643f20c102f944be199c983bb8f2364313 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Mon, 25 Feb 2019 23:08:35 +0100 Subject: [PATCH 10/80] * Mon Feb 25 2019 Lukas Vrabec - 0.1.3-3 - Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8 - Add check if runtimes are installed on the system --- sources | 2 +- udica.spec | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/sources b/sources index cbd8a1c..25beb93 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.3.tar.gz) = c0ef057f30ae4475c08d5a2972110b3608d535dd02ecb4c8aaeef676cf0510c28410063573613487e3a647f5a4c507b6eb831edaf3ab3c5de06b1fda62e2b603 +SHA512 (v0.1.3.tar.gz) = a9063c940e61a58f779a809c0a3b76841ffafe3f47c101ed8d8cd5abfbd81cfc7e00b0867ddaa9004cb6d99176f1d061f7ade744125b5030e006a9cd7aa9e5b3 diff --git a/udica.spec b/udica.spec index 069b57f..4270b41 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.1.3 -Release: 2%{?dist} +Release: 3%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Feb 25 2019 Lukas Vrabec - 0.1.3-3 +- Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8 +- Add check if runtimes are installed on the system + * Sun Feb 17 2019 Lukas Vrabec - 0.1.3-2 - Improve capability parsing for docker containers - Update small changes in manpage, like issue with mandatory option '-c' for docker containers From 003b3a8115ccbe5ee7483928e8d726c422b49c43 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Mon, 11 Mar 2019 13:44:57 +0100 Subject: [PATCH 11/80] * Mon Mar 11 2019 Lukas Vrabec - 0.1.4-1 - Fix minor problems reported by pylint #11 - Catch FileNotFoundError when inspecting containers #12 - Create basic tests #13 - Restore working directory #14 - udica cannot use the container ID once it is provided #10 --- .gitignore | 1 + sources | 2 +- udica.spec | 11 +++++++++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index a5b182f..a75055a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ /v0.1.1.tar.gz /v0.1.2.tar.gz /v0.1.3.tar.gz +/v0.1.4.tar.gz diff --git a/sources b/sources index 25beb93..eb5bafb 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.3.tar.gz) = a9063c940e61a58f779a809c0a3b76841ffafe3f47c101ed8d8cd5abfbd81cfc7e00b0867ddaa9004cb6d99176f1d061f7ade744125b5030e006a9cd7aa9e5b3 +SHA512 (v0.1.4.tar.gz) = 08afb8b16bbc44c87bc8ec0c91f9893650c9e47a94f8c1f75750ec98ae08bc23a00b25b99968481e7a296d6e3232d17a29358fbfc91f1e15af1e3225b2f5a7c9 diff --git a/udica.spec b/udica.spec index 0474261..7b3dccc 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.3 -Release: 4%{?dist} +Version: 0.1.4 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,13 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Mar 11 2019 Lukas Vrabec - 0.1.4-1 +- Fix minor problems reported by pylint #11 +- Catch FileNotFoundError when inspecting containers #12 +- Create basic tests #13 +- Restore working directory #14 +- udica cannot use the container ID once it is provided #10 + * Mon Feb 25 2019 Lukas Vrabec - 0.1.3-4 - Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8 - Add check if runtimes are installed on the system From 784da55c54415b2bd0e9b1970f6985ea8acb8705 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Mon, 11 Mar 2019 13:44:57 +0100 Subject: [PATCH 12/80] * Mon Mar 11 2019 Lukas Vrabec - 0.1.4-1 - Fix minor problems reported by pylint #11 - Catch FileNotFoundError when inspecting containers #12 - Create basic tests #13 - Restore working directory #14 - udica cannot use the container ID once it is provided #10 --- .gitignore | 1 + sources | 2 +- udica.spec | 11 +++++++++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index a5b182f..a75055a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ /v0.1.1.tar.gz /v0.1.2.tar.gz /v0.1.3.tar.gz +/v0.1.4.tar.gz diff --git a/sources b/sources index 25beb93..eb5bafb 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.3.tar.gz) = a9063c940e61a58f779a809c0a3b76841ffafe3f47c101ed8d8cd5abfbd81cfc7e00b0867ddaa9004cb6d99176f1d061f7ade744125b5030e006a9cd7aa9e5b3 +SHA512 (v0.1.4.tar.gz) = 08afb8b16bbc44c87bc8ec0c91f9893650c9e47a94f8c1f75750ec98ae08bc23a00b25b99968481e7a296d6e3232d17a29358fbfc91f1e15af1e3225b2f5a7c9 diff --git a/udica.spec b/udica.spec index 4270b41..adf0ad2 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.3 -Release: 3%{?dist} +Version: 0.1.4 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,13 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Mar 11 2019 Lukas Vrabec - 0.1.4-1 +- Fix minor problems reported by pylint #11 +- Catch FileNotFoundError when inspecting containers #12 +- Create basic tests #13 +- Restore working directory #14 +- udica cannot use the container ID once it is provided #10 + * Mon Feb 25 2019 Lukas Vrabec - 0.1.3-3 - Update manpage with the latest known bug described in https://github.com/containers/udica/issues/8 - Add check if runtimes are installed on the system From 4aea2395ce0e737c5c9bd1c06dd2dbdb27848753 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Fri, 19 Apr 2019 20:43:16 +0200 Subject: [PATCH 13/80] * Fri Apr 19 2019 Lukas Vrabec - 0.1.5-1 - Create mock selinux and semanage module - Update testing section in README - Add travis file for Travis CI - Grammar fixes in the udica.8 manpage file - Support port ranges (Resolves: #16) - Test port ranges --- .gitignore | 1 + sources | 2 +- udica.spec | 10 +++++++++- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index a75055a..3971a54 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /v0.1.2.tar.gz /v0.1.3.tar.gz /v0.1.4.tar.gz +/v0.1.5.tar.gz diff --git a/sources b/sources index eb5bafb..33dcb37 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.4.tar.gz) = 08afb8b16bbc44c87bc8ec0c91f9893650c9e47a94f8c1f75750ec98ae08bc23a00b25b99968481e7a296d6e3232d17a29358fbfc91f1e15af1e3225b2f5a7c9 +SHA512 (v0.1.5.tar.gz) = 38cb9b0c9d42f807d05811631d460af80e65db5631e53230ea129d79d9844eeddc9c3f63ff17c121150afb1319b08cf6da085ce3e18945f4bf76b844365f741c diff --git a/udica.spec b/udica.spec index 7b3dccc..ebea20e 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.4 +Version: 0.1.5 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -58,6 +58,14 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Apr 19 2019 Lukas Vrabec - 0.1.5-1 +- Create mock selinux and semanage module +- Update testing section in README +- Add travis file for Travis CI +- Grammar fixes in the udica.8 manpage file +- Support port ranges (Resolves: #16) +- Test port ranges + * Mon Mar 11 2019 Lukas Vrabec - 0.1.4-1 - Fix minor problems reported by pylint #11 - Catch FileNotFoundError when inspecting containers #12 From 94598a163ff02c538e78fd3571f41cf702ca0d26 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Thu, 25 Apr 2019 13:49:36 +0200 Subject: [PATCH 14/80] Add basic sanity tests --- tests/tests.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 tests/tests.yml diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..461cc5c --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,14 @@ +- hosts: localhost + tags: + - classic + - container + roles: + - role: standard-test-source + + - role: standard-test-basic + required_packages: + - python3 + tests: + - smoke: + dir: ./source/tests + run: python3 -m unittest From 0037a4e5ecd35f757bb09ec7f7aeee926333cbe1 Mon Sep 17 00:00:00 2001 From: Jan Zarsky Date: Mon, 29 Apr 2019 14:29:28 +0200 Subject: [PATCH 15/80] Add basic sanity integration tests Check that udica can create policy for both podman and docker containers. Check that generated policy can be loaded. Check that generated policy provides required access. --- tests/docker/runtest.sh | 65 ++++++++++++++++++++ tests/sanity/runtest.sh | 127 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 192 insertions(+) create mode 100755 tests/docker/runtest.sh create mode 100755 tests/sanity/runtest.sh diff --git a/tests/docker/runtest.sh b/tests/docker/runtest.sh new file mode 100755 index 0000000..c2290d5 --- /dev/null +++ b/tests/docker/runtest.sh @@ -0,0 +1,65 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Description: Compare udica output between podman and docker +# Author: Jan Zarsky +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="udica" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm "udica" + rlAssertRpm "policycoreutils" + rlAssertRpm "podman" + rlAssertRpm "docker" + rlRun "rlServiceStart docker" + OUTPUT_FILE=$(mktemp) + rlPhaseEnd + + rlPhaseStartTest + for BACKEND in podman docker ; do + rlRun "$BACKEND run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" + rlRun "$BACKEND ps | grep test" + CONT_ID=$($BACKEND ps | grep test | cut -d ' ' -f 1) + rlRun "udica -i $CONT_ID my_container" + rlRun "mv my_container.cil my_cont_$BACKEND.cil" + rlRun "$BACKEND stop test" + rlRun "$BACKEND rm test" + done + + rlRun "sed -i '/capability/d' my_cont_podman.cil" + rlRun "diff -b -B my_cont_podman.cil my_cont_docker.cil" + + rlRun "rm my_cont_podman.cil my_cont_docker.cil" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f $OUTPUT_FILE" + rlRun "rlServiceRestore docker" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh new file mode 100755 index 0000000..5c66cfe --- /dev/null +++ b/tests/sanity/runtest.sh @@ -0,0 +1,127 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Description: Test basic functionality of udica +# Author: Jan Zarsky +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="udica" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm "udica" + rlAssertRpm "policycoreutils" + rlAssertRpm "podman" + OUTPUT_FILE=$(mktemp) + rlPhaseEnd + + rlPhaseStartTest + rlRun "udica --help" + rlRun "PAGER=cat man udica" + rlPhaseEnd + + rlPhaseStartTest "Test basic scenario" + rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" + rlRun "podman ps | grep test" + rlRun "ps -efZ | grep bash" + rlRun "ps -efZ | grep bash | grep container_t" + + rlRun "podman exec test ls /home" 1,2 + rlRun "podman exec test touch /var/spool/test" 1 + rlWatchdog "rlRun \"podman exec test nc -l 53\"" 3 + + CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1) + rlRun "podman inspect $CONT_ID | udica my_container >$OUTPUT_FILE" + rlRun "podman stop test" + rlRun "podman rm test" + + rlRun "cat $OUTPUT_FILE" + rlAssertExists "my_container.cil" + SEMODULE=$(cat $OUTPUT_FILE | grep "semodule -i" | cut -d '#' -f 2) + rlRun "$SEMODULE" + + PODMAN_OPT=$(cat $OUTPUT_FILE | grep "security-opt" | cut -d '"' -f 2) + rlRun "podman run -dit --name test2 $PODMAN_OPT -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" + rlRun "podman ps | grep test2" + rlRun "ps -efZ | grep bash" + rlRun "ps -efZ | grep bash | grep my_container.process" + + rlRun "podman exec test2 ls /home" 0 + rlRun "podman exec test2 touch /var/spool/test" 0 + rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 1" 3 + + rlRun "podman stop test2" + rlRun "podman rm test2" + + rlRun "semodule -r my_container base_container net_container home_container" + rlRun "rm my_container.cil" + rlPhaseEnd + + rlPhaseStartTest "Compare different ways of obtaining policy" + rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" + rlRun "podman ps | grep test" + + CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1) + rlRun "podman inspect $CONT_ID | udica my_container >pipe.result" + + rlRun "podman inspect $CONT_ID >container.json" + rlRun "udica -j container.json my_container >json.result" + + rlRun "udica -i $CONT_ID my_container >id.result" + + rlRun "diff pipe.result json.result" + rlRun "diff pipe.result id.result" + + rlRun "rm -f pipe.result json.result id.result container.json" + rlRun "podman stop test" + rlRun "podman rm test" + rlPhaseEnd + + rlPhaseStartTest "Test loading modules" + rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" + rlRun "podman ps | grep test" + + CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1) + rlRun "podman inspect $CONT_ID | udica -l my_container" + + rlRun "podman stop test" + rlRun "podman rm test" + + rlRun "semodule -l >$OUTPUT_FILE" + rlAssertGrep "my_container" $OUTPUT_FILE + rlAssertGrep "base_container" $OUTPUT_FILE + rlAssertGrep "net_container" $OUTPUT_FILE + rlAssertGrep "home_container" $OUTPUT_FILE + + rlRun "semodule -r my_container base_container net_container home_container" + rlRun "rm my_container.cil" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f $OUTPUT_FILE" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From cc9c2dc12482a566cde61e5fb7892719b919cf53 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Tue, 30 Apr 2019 14:12:42 +0200 Subject: [PATCH 16/80] * Tue Apr 30 2019 Lukas Vrabec - 0.1.5-2 - Add allow rules for container_runtime_t to base_container.cil, Podman version 1.2.0 requires new allow rules. --- ...for-container_runtime_t-to-base_cont.patch | 29 +++++++++++++++++++ udica.spec | 6 +++- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch diff --git a/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch b/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch new file mode 100644 index 0000000..14761cb --- /dev/null +++ b/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch @@ -0,0 +1,29 @@ +From 129555625ceca2d73faf862501c10fb3ee49b473 Mon Sep 17 00:00:00 2001 +From: Jan Zarsky +Date: Tue, 30 Apr 2019 11:41:10 +0200 +Subject: [PATCH] Add allow rules for container_runtime_t to base_container.cil + +Podman version 1.2.0 requires new allow rules. + +Fixes: +type=AVC msg=audit(1556617434.540:447): avc: denied { create } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 +type=AVC msg=audit(1556617434.541:448): avc: denied { search } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 +type=AVC msg=audit(1556617434.541:449): avc: denied { view } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 +type=AVC msg=audit(1556617434.541:450): avc: denied { setattr } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 +--- + udica/templates/base_container.cil | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/udica/templates/base_container.cil b/udica/templates/base_container.cil +index 88bb39b..ab9b776 100644 +--- a/udica/templates/base_container.cil ++++ b/udica/templates/base_container.cil +@@ -5,4 +5,5 @@ + (typeattributeset container_domain (process )) + (allow process proc_type (file (getattr open read))) + (allow process cpu_online_t (file (getattr open read))) ++(allow container_runtime_t process (key (create link read search setattr view write))) + ) +-- +2.20.1 + diff --git a/udica.spec b/udica.spec index ebea20e..17759af 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.1.5 -Release: 1%{?dist} +Release: 2%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -13,6 +13,7 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif +patch00: 0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch %description Tool for generating SELinux security profiles for containers based on @@ -20,6 +21,7 @@ inspection of container JSON file. %prep %setup -q +%patch00 -p1 %build %if 0%{?fedora} || 0%{?rhel} > 7 @@ -58,6 +60,8 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Tue Apr 30 2019 Lukas Vrabec - 0.1.5-2 +- Add allow rules for container_runtime_t to base_container.cil, Podman version 1.2.0 requires new allow rules. * Fri Apr 19 2019 Lukas Vrabec - 0.1.5-1 - Create mock selinux and semanage module - Update testing section in README From f8f4c7531faf7cec4dbce0757dc5ce98590c455e Mon Sep 17 00:00:00 2001 From: Jan Zarsky Date: Tue, 7 May 2019 11:36:03 +0200 Subject: [PATCH 17/80] Add an option for running tests with real modules To simplify udica testing on Fedora, add an option that allows running the tests with real system packages (selinux and semanage). --- ...-for-running-tests-with-real-modules.patch | 51 +++++++++++++++++++ ...-Allow-running-test_main.py-directly.patch | 33 ++++++++++++ udica.spec | 7 +-- 3 files changed, 88 insertions(+), 3 deletions(-) create mode 100644 0002-Add-an-option-for-running-tests-with-real-modules.patch create mode 100644 0003-Allow-running-test_main.py-directly.patch diff --git a/0002-Add-an-option-for-running-tests-with-real-modules.patch b/0002-Add-an-option-for-running-tests-with-real-modules.patch new file mode 100644 index 0000000..d381746 --- /dev/null +++ b/0002-Add-an-option-for-running-tests-with-real-modules.patch @@ -0,0 +1,51 @@ +From ec0fa884fe5f3880c76fa08a6dac1fd3abee9d30 Mon Sep 17 00:00:00 2001 +From: Jan Zarsky +Date: Tue, 7 May 2019 10:48:00 +0200 +Subject: [PATCH 1/2] Add an option for running tests with real modules + +For testing purposes, the selinux and semanage modules are mocked. This +allows running the tests without SELinux enabled (e.g. in a container). +On SELinux-enabled systems, it makes sense to rerun the tests with the +actual selinux and semanage modules present on the system. For this +purpose, add a global constant named 'SELINUX_ENABLED'. +--- + tests/test_main.py | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/tests/test_main.py b/tests/test_main.py +index 9d8ac6d..08805db 100644 +--- a/tests/test_main.py ++++ b/tests/test_main.py +@@ -22,6 +22,11 @@ from unittest.mock import patch + sys.path.insert(0, os.path.abspath('..')) + import udica.__main__ + ++# Use the selinux and semanage packages provided by the system instead of the mock ones. When ++# running on a system with SELinux disabled (e.g. in a container), it must be set to False. ++# On RHEL, CentOS or Fedora it may be set to True. ++SELINUX_ENABLED = False ++ + class TestMain(unittest.TestCase): + """Test basic functionality of udica""" + +@@ -72,11 +77,17 @@ class TestMain(unittest.TestCase): + # FIXME: the load_policy function is not properly restoring current working directory + self.cwd = os.getcwd() + ++ if SELINUX_ENABLED: ++ sys.path = [path for path in sys.path if path not in (os.getcwd(), '')] ++ + import selinux + importlib.reload(selinux) + import semanage + importlib.reload(semanage) + ++ if SELINUX_ENABLED: ++ sys.path = [''] + sys.path ++ + with patch('sys.argv', args): + with patch('sys.stderr.write') as mock_err, patch('sys.stdout.write') as mock_out: + mock_out.output = "" +-- +2.20.1 + diff --git a/0003-Allow-running-test_main.py-directly.patch b/0003-Allow-running-test_main.py-directly.patch new file mode 100644 index 0000000..52a6752 --- /dev/null +++ b/0003-Allow-running-test_main.py-directly.patch @@ -0,0 +1,33 @@ +From aa7037f35c77ea1bbb78860e7dc3c40509a980d9 Mon Sep 17 00:00:00 2001 +From: Jan Zarsky +Date: Tue, 7 May 2019 11:03:36 +0200 +Subject: [PATCH 2/2] Allow running test_main.py directly + +By default, the tests are run using the 'python3 -m unittest' command. +Allow running 'test_main.py' directly so that the 'selinux_enabled' +argument can be specified. + +When running on SELinux-enabled systems, the tests can be rerun with: + + python3 test_main.py selinux_enabled +--- + tests/test_main.py | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tests/test_main.py b/tests/test_main.py +index 08805db..6f37cbd 100644 +--- a/tests/test_main.py ++++ b/tests/test_main.py +@@ -116,3 +116,9 @@ class TestMain(unittest.TestCase): + self.assertMultiLineEqual(policy, exp_policy) + + os.unlink('my_container.cil') ++ ++if __name__ == "__main__": ++ if 'selinux_enabled' in sys.argv: ++ SELINUX_ENABLED = True ++ sys.argv.remove('selinux_enabled') ++ unittest.main() +-- +2.20.1 + diff --git a/udica.spec b/udica.spec index 17759af..f717a10 100644 --- a/udica.spec +++ b/udica.spec @@ -13,15 +13,16 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif -patch00: 0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch +patch1: 0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch +patch2: 0002-Add-an-option-for-running-tests-with-real-modules.patch +patch3: 0003-Allow-running-test_main.py-directly.patch %description Tool for generating SELinux security profiles for containers based on inspection of container JSON file. %prep -%setup -q -%patch00 -p1 +%autosetup -p 1 %build %if 0%{?fedora} || 0%{?rhel} > 7 From 05d2672bdebb13dcc90cb6c94c9692e74569b370 Mon Sep 17 00:00:00 2001 From: Jan Zarsky Date: Tue, 7 May 2019 11:32:55 +0200 Subject: [PATCH 18/80] Run tests with real selinux and semanage modules The tests are by default using mock selinux and semanage modules. Rerun the tests with real modules. --- tests/tests.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/tests.yml b/tests/tests.yml index 461cc5c..d65e2ee 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -12,3 +12,6 @@ - smoke: dir: ./source/tests run: python3 -m unittest + - smoke2: + dir: ./source/tests + run: python3 test_main.py selinux_enabled From 5a7674a6530e551f5fb3e98a87c65dc2d52ef033 Mon Sep 17 00:00:00 2001 From: Jan Zarsky Date: Thu, 16 May 2019 15:41:17 +0200 Subject: [PATCH 19/80] Remove patches --- ...-for-running-tests-with-real-modules.patch | 51 ------------------- ...-Allow-running-test_main.py-directly.patch | 33 ------------ udica.spec | 2 - 3 files changed, 86 deletions(-) delete mode 100644 0002-Add-an-option-for-running-tests-with-real-modules.patch delete mode 100644 0003-Allow-running-test_main.py-directly.patch diff --git a/0002-Add-an-option-for-running-tests-with-real-modules.patch b/0002-Add-an-option-for-running-tests-with-real-modules.patch deleted file mode 100644 index d381746..0000000 --- a/0002-Add-an-option-for-running-tests-with-real-modules.patch +++ /dev/null @@ -1,51 +0,0 @@ -From ec0fa884fe5f3880c76fa08a6dac1fd3abee9d30 Mon Sep 17 00:00:00 2001 -From: Jan Zarsky -Date: Tue, 7 May 2019 10:48:00 +0200 -Subject: [PATCH 1/2] Add an option for running tests with real modules - -For testing purposes, the selinux and semanage modules are mocked. This -allows running the tests without SELinux enabled (e.g. in a container). -On SELinux-enabled systems, it makes sense to rerun the tests with the -actual selinux and semanage modules present on the system. For this -purpose, add a global constant named 'SELINUX_ENABLED'. ---- - tests/test_main.py | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/tests/test_main.py b/tests/test_main.py -index 9d8ac6d..08805db 100644 ---- a/tests/test_main.py -+++ b/tests/test_main.py -@@ -22,6 +22,11 @@ from unittest.mock import patch - sys.path.insert(0, os.path.abspath('..')) - import udica.__main__ - -+# Use the selinux and semanage packages provided by the system instead of the mock ones. When -+# running on a system with SELinux disabled (e.g. in a container), it must be set to False. -+# On RHEL, CentOS or Fedora it may be set to True. -+SELINUX_ENABLED = False -+ - class TestMain(unittest.TestCase): - """Test basic functionality of udica""" - -@@ -72,11 +77,17 @@ class TestMain(unittest.TestCase): - # FIXME: the load_policy function is not properly restoring current working directory - self.cwd = os.getcwd() - -+ if SELINUX_ENABLED: -+ sys.path = [path for path in sys.path if path not in (os.getcwd(), '')] -+ - import selinux - importlib.reload(selinux) - import semanage - importlib.reload(semanage) - -+ if SELINUX_ENABLED: -+ sys.path = [''] + sys.path -+ - with patch('sys.argv', args): - with patch('sys.stderr.write') as mock_err, patch('sys.stdout.write') as mock_out: - mock_out.output = "" --- -2.20.1 - diff --git a/0003-Allow-running-test_main.py-directly.patch b/0003-Allow-running-test_main.py-directly.patch deleted file mode 100644 index 52a6752..0000000 --- a/0003-Allow-running-test_main.py-directly.patch +++ /dev/null @@ -1,33 +0,0 @@ -From aa7037f35c77ea1bbb78860e7dc3c40509a980d9 Mon Sep 17 00:00:00 2001 -From: Jan Zarsky -Date: Tue, 7 May 2019 11:03:36 +0200 -Subject: [PATCH 2/2] Allow running test_main.py directly - -By default, the tests are run using the 'python3 -m unittest' command. -Allow running 'test_main.py' directly so that the 'selinux_enabled' -argument can be specified. - -When running on SELinux-enabled systems, the tests can be rerun with: - - python3 test_main.py selinux_enabled ---- - tests/test_main.py | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/tests/test_main.py b/tests/test_main.py -index 08805db..6f37cbd 100644 ---- a/tests/test_main.py -+++ b/tests/test_main.py -@@ -116,3 +116,9 @@ class TestMain(unittest.TestCase): - self.assertMultiLineEqual(policy, exp_policy) - - os.unlink('my_container.cil') -+ -+if __name__ == "__main__": -+ if 'selinux_enabled' in sys.argv: -+ SELINUX_ENABLED = True -+ sys.argv.remove('selinux_enabled') -+ unittest.main() --- -2.20.1 - diff --git a/udica.spec b/udica.spec index f717a10..343f0b0 100644 --- a/udica.spec +++ b/udica.spec @@ -14,8 +14,6 @@ BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif patch1: 0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch -patch2: 0002-Add-an-option-for-running-tests-with-real-modules.patch -patch3: 0003-Allow-running-test_main.py-directly.patch %description Tool for generating SELinux security profiles for containers based on From d41c9dc7d9f07de21a822aa810140d96d5755e9b Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Thu, 16 May 2019 19:36:00 +0200 Subject: [PATCH 20/80] * Thu May 16 2019 Lukas Vrabec - 0.1.6-1 - New rebase with upstream adding new tests --- .gitignore | 1 + ...for-container_runtime_t-to-base_cont.patch | 29 ------------------- sources | 2 +- udica.spec | 8 +++-- 4 files changed, 7 insertions(+), 33 deletions(-) delete mode 100644 0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch diff --git a/.gitignore b/.gitignore index 3971a54..0aad5ab 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /v0.1.3.tar.gz /v0.1.4.tar.gz /v0.1.5.tar.gz +/v0.1.6.tar.gz diff --git a/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch b/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch deleted file mode 100644 index 14761cb..0000000 --- a/0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 129555625ceca2d73faf862501c10fb3ee49b473 Mon Sep 17 00:00:00 2001 -From: Jan Zarsky -Date: Tue, 30 Apr 2019 11:41:10 +0200 -Subject: [PATCH] Add allow rules for container_runtime_t to base_container.cil - -Podman version 1.2.0 requires new allow rules. - -Fixes: -type=AVC msg=audit(1556617434.540:447): avc: denied { create } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 -type=AVC msg=audit(1556617434.541:448): avc: denied { search } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 -type=AVC msg=audit(1556617434.541:449): avc: denied { view } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 -type=AVC msg=audit(1556617434.541:450): avc: denied { setattr } for pid=4692 comm="runc:[2:INIT]" scontext=unconfined_u:system_r:container_runtime_t:s0 tcontext=system_u:system_r:my_container.process:s0:c157,c366 tclass=key permissive=1 ---- - udica/templates/base_container.cil | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/udica/templates/base_container.cil b/udica/templates/base_container.cil -index 88bb39b..ab9b776 100644 ---- a/udica/templates/base_container.cil -+++ b/udica/templates/base_container.cil -@@ -5,4 +5,5 @@ - (typeattributeset container_domain (process )) - (allow process proc_type (file (getattr open read))) - (allow process cpu_online_t (file (getattr open read))) -+(allow container_runtime_t process (key (create link read search setattr view write))) - ) --- -2.20.1 - diff --git a/sources b/sources index 33dcb37..c6861a0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.5.tar.gz) = 38cb9b0c9d42f807d05811631d460af80e65db5631e53230ea129d79d9844eeddc9c3f63ff17c121150afb1319b08cf6da085ce3e18945f4bf76b844365f741c +SHA512 (v0.1.6.tar.gz) = 1da3cd6e6c4a70b9ad76f3ccc6eb5f2418544ab778ec07145d1c44a7df6092d769a0afe4335e3b8afac444399e7fa720de65d1dfe2badb9a232ed70a3ea36386 diff --git a/udica.spec b/udica.spec index 343f0b0..001320d 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.5 -Release: 2%{?dist} +Version: 0.1.6 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -13,7 +13,6 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif -patch1: 0001-Add-allow-rules-for-container_runtime_t-to-base_cont.patch %description Tool for generating SELinux security profiles for containers based on @@ -59,6 +58,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Thu May 16 2019 Lukas Vrabec - 0.1.6-1 +- New rebase with upstream adding new tests + * Tue Apr 30 2019 Lukas Vrabec - 0.1.5-2 - Add allow rules for container_runtime_t to base_container.cil, Podman version 1.2.0 requires new allow rules. * Fri Apr 19 2019 Lukas Vrabec - 0.1.5-1 From 0ed8760d598593f01a66e4d5e0ed27b457760a22 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Thu, 16 May 2019 16:06:40 +0200 Subject: [PATCH 21/80] Update tests suite with downstream test Following commit adds new donwstream beakerlib sanity test --- tests/tests.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/tests.yml b/tests/tests.yml index d65e2ee..355fc5d 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -15,3 +15,11 @@ - smoke2: dir: ./source/tests run: python3 test_main.py selinux_enabled + + - role: standard-test-beakerlib + tags: + - classic + tests: + - sanity + required_packages: + - podman From 5e1c32f75c778eeced4f05a3a81e1bb4b66a1197 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 12 Jun 2019 13:54:49 +0200 Subject: [PATCH 22/80] * Wed Jun 12 2019 Lukas Vrabec - 0.1.7-1 - New rebase with upstream adding new param --ansible, to generate ansible playbook for deploying policies. https://github.com/containers/udica/releases/tag/v0.1.7 --- .gitignore | 1 + sources | 2 +- udica.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 0aad5ab..d314a70 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ /v0.1.4.tar.gz /v0.1.5.tar.gz /v0.1.6.tar.gz +/v0.1.7.tar.gz diff --git a/sources b/sources index c6861a0..a3976f7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.6.tar.gz) = 1da3cd6e6c4a70b9ad76f3ccc6eb5f2418544ab778ec07145d1c44a7df6092d769a0afe4335e3b8afac444399e7fa720de65d1dfe2badb9a232ed70a3ea36386 +SHA512 (v0.1.7.tar.gz) = 010dd2b7583a9b6598149395cd16038ff6fbf56c02c739c58903fc55e5651e35e83cdc54c8463ed0a3efe3919c1afd8d98fd6118cc01e76f5aeff6e7213283f6 diff --git a/udica.spec b/udica.spec index 001320d..8e91f3c 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.6 +Version: 0.1.7 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -58,6 +58,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Jun 12 2019 Lukas Vrabec - 0.1.7-1 +- New rebase with upstream adding new param --ansible, to generate ansible playbook for deploying policies. https://github.com/containers/udica/releases/tag/v0.1.7 + * Thu May 16 2019 Lukas Vrabec - 0.1.6-1 - New rebase with upstream adding new tests From 4312e208b78ddce46dbdad3a2ec7eabe9dd083e2 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 12 Jun 2019 14:10:23 +0200 Subject: [PATCH 23/80] Update spec file to include /usr/share/udica/ansible directory with all files. --- udica.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/udica.spec b/udica.spec index 8e91f3c..8ccb8bc 100644 --- a/udica.spec +++ b/udica.spec @@ -44,7 +44,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %{_mandir}/man8/udica.8* %{_bindir}/udica %dir %{_datadir}/udica +%dir %{_datadir}/udica/ansible %dir %{_datadir}/udica/templates +%{_datadir}/udica/ansible/* %{_datadir}/udica/templates/* %if 0%{?fedora} || 0%{?rhel} > 7 From 808f49828384b47d6a332c624f1b531ec31ad3d2 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Thu, 11 Jul 2019 13:08:38 +0200 Subject: [PATCH 24/80] * Thu Jul 11 2019 Lukas Vrabec - 0.1.8-1 - New rebase https://github.com/containers/udica/releases/tag/v0.1.8 --- .gitignore | 1 + sources | 2 +- udica.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d314a70..1990382 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ /v0.1.5.tar.gz /v0.1.6.tar.gz /v0.1.7.tar.gz +/v0.1.8.tar.gz diff --git a/sources b/sources index a3976f7..4fb2ded 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.7.tar.gz) = 010dd2b7583a9b6598149395cd16038ff6fbf56c02c739c58903fc55e5651e35e83cdc54c8463ed0a3efe3919c1afd8d98fd6118cc01e76f5aeff6e7213283f6 +SHA512 (v0.1.8.tar.gz) = ada8f3183904ac0aa1715e564f708ce3bda02719ecc2587e3774205bba39e585f2df7392861317a4324e8ea2c2f6fa031c3a0f440be6ca5408398b238089b891 diff --git a/udica.spec b/udica.spec index 8ccb8bc..bcadfb5 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.7 +Version: 0.1.8 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Thu Jul 11 2019 Lukas Vrabec - 0.1.8-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.1.8 + * Wed Jun 12 2019 Lukas Vrabec - 0.1.7-1 - New rebase with upstream adding new param --ansible, to generate ansible playbook for deploying policies. https://github.com/containers/udica/releases/tag/v0.1.7 From fa1600ac43c31d2a5bfb260b36fd675fbb8e527c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jul 2019 02:19:45 +0000 Subject: [PATCH 25/80] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index bcadfb5..62a4bda 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.1.8 -Release: 1%{?dist} +Release: 2%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sat Jul 27 2019 Fedora Release Engineering - 0.1.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Thu Jul 11 2019 Lukas Vrabec - 0.1.8-1 - New rebase https://github.com/containers/udica/releases/tag/v0.1.8 From 169e2040280b5b1221c9dc182aeb736944faf39a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 19 Aug 2019 11:08:38 +0200 Subject: [PATCH 26/80] Rebuilt for Python 3.8 --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 62a4bda..a6fa488 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.1.8 -Release: 2%{?dist} +Release: 3%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Aug 19 2019 Miro Hrončok - 0.1.8-3 +- Rebuilt for Python 3.8 + * Sat Jul 27 2019 Fedora Release Engineering - 0.1.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From c78730bf59b528b8c497fc1448f1efb54b7514ab Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 28 Aug 2019 13:04:39 +0200 Subject: [PATCH 27/80] * Wed Aug 28 2019 Lukas Vrabec - 0.1.9-1 - Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2 - New rebase https://github.com/containers/udica/releases/tag/v0.1.9 --- .gitignore | 1 + ...t_basic.podman.cil-test_basic.docker.patch | 61 +++++++++++++++++++ sources | 2 +- udica.spec | 9 ++- 4 files changed, 70 insertions(+), 3 deletions(-) create mode 100644 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch diff --git a/.gitignore b/.gitignore index 1990382..0da17d5 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ /v0.1.6.tar.gz /v0.1.7.tar.gz /v0.1.8.tar.gz +/v0.1.9.tar.gz diff --git a/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch b/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch new file mode 100644 index 0000000..eda87e3 --- /dev/null +++ b/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch @@ -0,0 +1,61 @@ +From 1ef277aa4840a72ff474f6500bcc6576f37af0af Mon Sep 17 00:00:00 2001 +From: Lukas Vrabec +Date: Tue, 27 Aug 2019 21:20:16 +0200 +Subject: [PATCH] Update tests test_basic.podman.cil, test_basic.docker.cil. + Round 2 + +Because of the new versions of SELinux policy in Fedora 30 and Fedora +Rawhide, also several tests in Udica needed to be fixed to use new +labels. +--- + tests/semanage.py | 1 - + tests/test_basic.docker.cil | 3 --- + tests/test_basic.podman.cil | 5 +---- + 3 files changed, 1 insertion(+), 8 deletions(-) + +diff --git a/tests/semanage.py b/tests/semanage.py +index f64fda4..318a46a 100644 +--- a/tests/semanage.py ++++ b/tests/semanage.py +@@ -156,7 +156,6 @@ fcontexts_homedirs = [ + ('/var/spool/fcron/new\\.systab', 'system_u:object_r:system_cron_spool_t:s0'), + ('/var/spool/fcron/systab\\.orig', 'system_u:object_r:system_cron_spool_t:s0'), + ('/var/spool/postfix/etc/localtime', 'system_u:object_r:locale_t:s0'), +- ('/var/spool/cron', 'system_u:object_r:user_cron_spool_t:s0'), + ('/var/spool/cron/user', 'system_u:object_r:user_cron_spool_t:s0') + ] + +diff --git a/tests/test_basic.docker.cil b/tests/test_basic.docker.cil +index b29cb32..220c53b 100644 +--- a/tests/test_basic.docker.cil ++++ b/tests/test_basic.docker.cil +@@ -285,9 +285,6 @@ + (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) +- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) +- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) +- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) + (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process var_spool_t ( sock_file ( getattr read write append open ))) +diff --git a/tests/test_basic.podman.cil b/tests/test_basic.podman.cil +index 06b44e3..618fe07 100644 +--- a/tests/test_basic.podman.cil ++++ b/tests/test_basic.podman.cil +@@ -287,10 +287,7 @@ + (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) +- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) +- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) +- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) + (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) + (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) + (allow process var_spool_t ( sock_file ( getattr read write append open ))) +-) +\ No newline at end of file ++) +-- +2.21.0 + diff --git a/sources b/sources index 4fb2ded..34d429b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.8.tar.gz) = ada8f3183904ac0aa1715e564f708ce3bda02719ecc2587e3774205bba39e585f2df7392861317a4324e8ea2c2f6fa031c3a0f440be6ca5408398b238089b891 +SHA512 (v0.1.9.tar.gz) = 24cbece968e8a494074297cf62b80d71b862bfe9366d30be5dd0be5158609b20358a1de42932584c2ead0f75d2a197fb57e0856c391e82975f70eba6a51a2ec3 diff --git a/udica.spec b/udica.spec index a6fa488..ea28414 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.8 -Release: 3%{?dist} +Version: 0.1.9 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -13,6 +13,7 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif +patch01: 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch %description Tool for generating SELinux security profiles for containers based on @@ -60,6 +61,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Aug 28 2019 Lukas Vrabec - 0.1.9-1 +- Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2 +- New rebase https://github.com/containers/udica/releases/tag/v0.1.9 + * Mon Aug 19 2019 Miro Hrončok - 0.1.8-3 - Rebuilt for Python 3.8 From 10b87117f0129fcd4ac572d061daae3568a9c0e0 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Tue, 27 Aug 2019 20:58:23 +0200 Subject: [PATCH 28/80] Fix sanity test suite Fix sanity test to pass on Fedora Rawhide and Fedora 30. Changes are related to missing 'nc' command in container for which SELinux policy is generated. --- tests/sanity/runtest.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh index 5c66cfe..c8c5f34 100755 --- a/tests/sanity/runtest.sh +++ b/tests/sanity/runtest.sh @@ -51,12 +51,13 @@ rlJournalStart rlRun "podman exec test ls /home" 1,2 rlRun "podman exec test touch /var/spool/test" 1 + rlRun "podman exec test dnf install nmap-ncat -y" 0 rlWatchdog "rlRun \"podman exec test nc -l 53\"" 3 CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1) rlRun "podman inspect $CONT_ID | udica my_container >$OUTPUT_FILE" rlRun "podman stop test" - rlRun "podman rm test" + rlRun "podman rm --force test" rlRun "cat $OUTPUT_FILE" rlAssertExists "my_container.cil" @@ -71,10 +72,11 @@ rlJournalStart rlRun "podman exec test2 ls /home" 0 rlRun "podman exec test2 touch /var/spool/test" 0 - rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 1" 3 + rlRun "podman exec test2 dnf install nmap-ncat -y" 0 + rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 2" 3 rlRun "podman stop test2" - rlRun "podman rm test2" + rlRun "podman rm --force test2" rlRun "semodule -r my_container base_container net_container home_container" rlRun "rm my_container.cil" From 889004a5479a4ddefdf1fdbf0dc79c371927da19 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 25 Sep 2019 10:20:25 +0200 Subject: [PATCH 29/80] * Wed Sep 25 2019 Lukas Vrabec - 0.2.0-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.0 --- .gitignore | 1 + sources | 2 +- udica.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 0da17d5..350b77a 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ /v0.1.7.tar.gz /v0.1.8.tar.gz /v0.1.9.tar.gz +/v0.2.0.tar.gz diff --git a/sources b/sources index 34d429b..1a3ad05 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.1.9.tar.gz) = 24cbece968e8a494074297cf62b80d71b862bfe9366d30be5dd0be5158609b20358a1de42932584c2ead0f75d2a197fb57e0856c391e82975f70eba6a51a2ec3 +SHA512 (v0.2.0.tar.gz) = 9ab2740b9911f9218ebf2b9cfb5b7fca04210d8fd9a32cf81c8e74d94c3dc414dd3fcbb2d028b86a227cb4c70129af1f433931767be64cea942932368128cc25 diff --git a/udica.spec b/udica.spec index ea28414..3231d7b 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.1.9 +Version: 0.2.0 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -61,6 +61,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Sep 25 2019 Lukas Vrabec - 0.2.0-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.0 + * Wed Aug 28 2019 Lukas Vrabec - 0.1.9-1 - Update tests test_basic.podman.cil, test_basic.docker.cil. Round 2 - New rebase https://github.com/containers/udica/releases/tag/v0.1.9 From c6e6561646e3587556b032c8e676e4c8de1bf4e3 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 25 Sep 2019 10:25:50 +0200 Subject: [PATCH 30/80] Remove patch which is already part of new rebase --- ...t_basic.podman.cil-test_basic.docker.patch | 61 ------------------- udica.spec | 1 - 2 files changed, 62 deletions(-) delete mode 100644 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch diff --git a/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch b/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch deleted file mode 100644 index eda87e3..0000000 --- a/0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 1ef277aa4840a72ff474f6500bcc6576f37af0af Mon Sep 17 00:00:00 2001 -From: Lukas Vrabec -Date: Tue, 27 Aug 2019 21:20:16 +0200 -Subject: [PATCH] Update tests test_basic.podman.cil, test_basic.docker.cil. - Round 2 - -Because of the new versions of SELinux policy in Fedora 30 and Fedora -Rawhide, also several tests in Udica needed to be fixed to use new -labels. ---- - tests/semanage.py | 1 - - tests/test_basic.docker.cil | 3 --- - tests/test_basic.podman.cil | 5 +---- - 3 files changed, 1 insertion(+), 8 deletions(-) - -diff --git a/tests/semanage.py b/tests/semanage.py -index f64fda4..318a46a 100644 ---- a/tests/semanage.py -+++ b/tests/semanage.py -@@ -156,7 +156,6 @@ fcontexts_homedirs = [ - ('/var/spool/fcron/new\\.systab', 'system_u:object_r:system_cron_spool_t:s0'), - ('/var/spool/fcron/systab\\.orig', 'system_u:object_r:system_cron_spool_t:s0'), - ('/var/spool/postfix/etc/localtime', 'system_u:object_r:locale_t:s0'), -- ('/var/spool/cron', 'system_u:object_r:user_cron_spool_t:s0'), - ('/var/spool/cron/user', 'system_u:object_r:user_cron_spool_t:s0') - ] - -diff --git a/tests/test_basic.docker.cil b/tests/test_basic.docker.cil -index b29cb32..220c53b 100644 ---- a/tests/test_basic.docker.cil -+++ b/tests/test_basic.docker.cil -@@ -285,9 +285,6 @@ - (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) -- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) -- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) -- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) - (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process var_spool_t ( sock_file ( getattr read write append open ))) -diff --git a/tests/test_basic.podman.cil b/tests/test_basic.podman.cil -index 06b44e3..618fe07 100644 ---- a/tests/test_basic.podman.cil -+++ b/tests/test_basic.podman.cil -@@ -287,10 +287,7 @@ - (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) -- (allow process user_cron_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) -- (allow process user_cron_spool_t ( file ( getattr read write append ioctl lock map open create ))) -- (allow process user_cron_spool_t ( sock_file ( getattr read write append open ))) - (allow process var_spool_t ( dir ( open read getattr lock search ioctl add_name remove_name write ))) - (allow process var_spool_t ( file ( getattr read write append ioctl lock map open create ))) - (allow process var_spool_t ( sock_file ( getattr read write append open ))) --) -\ No newline at end of file -+) --- -2.21.0 - diff --git a/udica.spec b/udica.spec index 3231d7b..2e69598 100644 --- a/udica.spec +++ b/udica.spec @@ -13,7 +13,6 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif -patch01: 0001-Update-tests-test_basic.podman.cil-test_basic.docker.patch %description Tool for generating SELinux security profiles for containers based on From 10b8af40571fec464bf847d21d840382de09e175 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 2 Oct 2019 16:59:23 +0200 Subject: [PATCH 31/80] Fix CI tests on udica In version v0.2.0 there is new makefile also for testing part, therefore we changed how to execute tests. This commit fixes the Fedora CI. --- tests/tests.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/tests.yml b/tests/tests.yml index 355fc5d..42a2022 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -10,11 +10,11 @@ - python3 tests: - smoke: - dir: ./source/tests - run: python3 -m unittest + dir: ./source + run: python3 -m unittest -v tests/test_unit.py - smoke2: - dir: ./source/tests - run: python3 test_main.py selinux_enabled + dir: ./source + run: python3 tests/test_integration.py - role: standard-test-beakerlib tags: From 0bfe40deebdd8ed096e5661040f4d0bd44a4e48b Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Fri, 25 Oct 2019 22:15:32 +0200 Subject: [PATCH 32/80] * Fri Oct 25 2019 Lukas Vrabec - 0.2.1-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.1 --- .gitignore | 1 + sources | 2 +- udica.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 350b77a..2eda2e5 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ /v0.1.8.tar.gz /v0.1.9.tar.gz /v0.2.0.tar.gz +/v0.2.1.tar.gz diff --git a/sources b/sources index 1a3ad05..208ce65 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.0.tar.gz) = 9ab2740b9911f9218ebf2b9cfb5b7fca04210d8fd9a32cf81c8e74d94c3dc414dd3fcbb2d028b86a227cb4c70129af1f433931767be64cea942932368128cc25 +SHA512 (v0.2.1.tar.gz) = 11238515e704faaffb0ba29ba99d07dfb21ca4628d496710231b8bcac640083b28d76b092ac3237b7d46922f2454d89ba1e0e00ba8378bb2f8c828c8d53500bf diff --git a/udica.spec b/udica.spec index 2e69598..da468df 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.0 +Version: 0.2.1 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Oct 25 2019 Lukas Vrabec - 0.2.1-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.1 + * Wed Sep 25 2019 Lukas Vrabec - 0.2.0-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.0 From 6f387b8ffffb24bf5a95f2bd1a2d1383af116a6f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 31 Jan 2020 02:26:26 +0000 Subject: [PATCH 33/80] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index da468df..4b82c2c 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.1 -Release: 1%{?dist} +Release: 2%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Jan 31 2020 Fedora Release Engineering - 0.2.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Fri Oct 25 2019 Lukas Vrabec - 0.2.1-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.1 From 9f4d139c0d7a9ce8dfb0d6d311f92998bcfbf3ac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 26 May 2020 03:53:49 +0200 Subject: [PATCH 34/80] Rebuilt for Python 3.9 --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 4b82c2c..532cbad 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.1 -Release: 2%{?dist} +Release: 3%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Tue May 26 2020 Miro Hrončok - 0.2.1-3 +- Rebuilt for Python 3.9 + * Fri Jan 31 2020 Fedora Release Engineering - 0.2.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From 40b7e497040b4ca605122a37eadd3b1bae2801dd Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jul 2020 13:10:13 +0000 Subject: [PATCH 35/80] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 532cbad..fbe3bae 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.1 -Release: 3%{?dist} +Release: 4%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Jul 29 2020 Fedora Release Engineering - 0.2.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Tue May 26 2020 Miro Hrončok - 0.2.1-3 - Rebuilt for Python 3.9 From fe5d49441050c0227d4838c54a507bfc0e4071c2 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Mon, 3 Aug 2020 19:05:31 +0200 Subject: [PATCH 36/80] * Mon Aug 03 2020 Lukas Vrabec - 0.2.2-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.2 --- .gitignore | 1 + sources | 2 +- udica.spec | 7 +++++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2eda2e5..f5c3092 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ /v0.1.9.tar.gz /v0.2.0.tar.gz /v0.2.1.tar.gz +/v0.2.2.tar.gz diff --git a/sources b/sources index 208ce65..3c7abe4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.1.tar.gz) = 11238515e704faaffb0ba29ba99d07dfb21ca4628d496710231b8bcac640083b28d76b092ac3237b7d46922f2454d89ba1e0e00ba8378bb2f8c828c8d53500bf +SHA512 (v0.2.2.tar.gz) = 647601690462551c51945c769ebaf5963b51703df656a3eb1098199c84e19f26e580ebb89b37451cd8651c24afba071896be2064abe09b8130b25cacc7fda575 diff --git a/udica.spec b/udica.spec index fbe3bae..2591fe4 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.1 -Release: 4%{?dist} +Version: 0.2.2 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Aug 03 2020 Lukas Vrabec - 0.2.2-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.2 + * Wed Jul 29 2020 Fedora Release Engineering - 0.2.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From e23d97dbf9a4ec25fcbb29217dbf54ba68c4738c Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Thu, 13 Aug 2020 17:35:37 +0200 Subject: [PATCH 37/80] * Thu Aug 13 2020 Lukas Vrabec - 0.2.3-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.3 --- .gitignore | 1 + sources | 2 +- udica.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index f5c3092..6300524 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ /v0.2.0.tar.gz /v0.2.1.tar.gz /v0.2.2.tar.gz +/v0.2.3.tar.gz diff --git a/sources b/sources index 3c7abe4..3483d53 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.2.tar.gz) = 647601690462551c51945c769ebaf5963b51703df656a3eb1098199c84e19f26e580ebb89b37451cd8651c24afba071896be2064abe09b8130b25cacc7fda575 +SHA512 (v0.2.3.tar.gz) = 78e6bae5a26e50ddc01a251802a02d6c48d8a87a8a1c343f9b40d0b2fdafbe435d62e6c1b6fb7c1365f536fac02f01d9057b2ffdaef27a9f91f3b245840754fb diff --git a/udica.spec b/udica.spec index 2591fe4..d2cef65 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.2 +Version: 0.2.3 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Thu Aug 13 2020 Lukas Vrabec - 0.2.3-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.3 + * Mon Aug 03 2020 Lukas Vrabec - 0.2.2-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.2 From 651491f476d15103e9cf6f35f6b3dd0111975e8e Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 25 Nov 2020 18:12:12 +0100 Subject: [PATCH 38/80] * Wed Nov 25 2020 Lukas Vrabec - 0.2.4-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.4 --- .gitignore | 1 + sources | 2 +- udica.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 6300524..e27bbaa 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ /v0.2.1.tar.gz /v0.2.2.tar.gz /v0.2.3.tar.gz +/v0.2.4.tar.gz diff --git a/sources b/sources index 3483d53..54ee37a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.3.tar.gz) = 78e6bae5a26e50ddc01a251802a02d6c48d8a87a8a1c343f9b40d0b2fdafbe435d62e6c1b6fb7c1365f536fac02f01d9057b2ffdaef27a9f91f3b245840754fb +SHA512 (v0.2.4.tar.gz) = 17d4d33939e15a113badf7df17b55c51cdf2659b49f6ae90c8e2f0b741ffabed019ee2b9a1dd8123f5ca96f3f1111fcad74d8480fdf00bc1b10b6e2d5f2948a4 diff --git a/udica.spec b/udica.spec index d2cef65..fa0d784 100644 --- a/udica.spec +++ b/udica.spec @@ -1,6 +1,6 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.3 +Version: 0.2.4 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Nov 25 2020 Lukas Vrabec - 0.2.4-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.4 + * Thu Aug 13 2020 Lukas Vrabec - 0.2.3-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.3 From fa6f003ec4023f3ffac7eb7d01e1e79fccf51a04 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Sun, 13 Dec 2020 15:23:31 +0100 Subject: [PATCH 39/80] * Sun Dec 13 2020 Lukas Vrabec - 0.2.4-2 - Add %check section to run basic tests during rpm build process --- udica.spec | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/udica.spec b/udica.spec index fa0d784..2ea7cd3 100644 --- a/udica.spec +++ b/udica.spec @@ -1,13 +1,13 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.4 -Release: 1%{?dist} +Release: 2%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica %if 0%{?fedora} || 0%{?rhel} > 7 -BuildRequires: python3 python3-devel python3-setuptools +BuildRequires: python3 python3-devel python3-setuptools python3-pyflakes black Requires: python3 python3-libsemanage python3-libselinux %else BuildRequires: python2 python2-devel python2-setuptools @@ -40,6 +40,9 @@ install --directory %%{buildroot}%{_datadir}/udica/templates install --directory %{buildroot}%{_mandir}/man8 install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 +%check +make test + %files %{_mandir}/man8/udica.8* %{_bindir}/udica @@ -60,6 +63,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sun Dec 13 2020 Lukas Vrabec - 0.2.4-2 +- Add %check section to run basic tests during rpm build process + * Wed Nov 25 2020 Lukas Vrabec - 0.2.4-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.4 From 4dc4b32e96018a0323a45a279a00f6e42d5ff0f7 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Tue, 12 Jan 2021 01:31:56 +0000 Subject: [PATCH 40/80] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- udica.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/udica.spec b/udica.spec index 2ea7cd3..0a5ce2b 100644 --- a/udica.spec +++ b/udica.spec @@ -6,6 +6,7 @@ Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica +BuildRequires: make %if 0%{?fedora} || 0%{?rhel} > 7 BuildRequires: python3 python3-devel python3-setuptools python3-pyflakes black Requires: python3 python3-libsemanage python3-libselinux From 1adfa9bfe1c23cafbf082458113702b7a48c8ee8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 22:33:53 +0000 Subject: [PATCH 41/80] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 0a5ce2b..eea4109 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.4 -Release: 2%{?dist} +Release: 3%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -64,6 +64,9 @@ make test %endif %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 0.2.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Sun Dec 13 2020 Lukas Vrabec - 0.2.4-2 - Add %check section to run basic tests during rpm build process From d4f16fdce9eb2db8652d54acb53f6cee05e8d33a Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 9 Mar 2021 20:47:37 +0100 Subject: [PATCH 42/80] Revert "Add %check section to run basic tests during rpm build process" The check is not necessary since it's part of the CI and brings needless dependencies. This reverts commits fa6f003ec4023f3ffac7eb7d01e1e79fccf51a04 and 4dc4b32e96018a0323a45a279a00f6e42d5ff0f7. --- udica.spec | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/udica.spec b/udica.spec index eea4109..ebd5ce2 100644 --- a/udica.spec +++ b/udica.spec @@ -6,9 +6,8 @@ Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica -BuildRequires: make %if 0%{?fedora} || 0%{?rhel} > 7 -BuildRequires: python3 python3-devel python3-setuptools python3-pyflakes black +BuildRequires: python3 python3-devel python3-setuptools Requires: python3 python3-libsemanage python3-libselinux %else BuildRequires: python2 python2-devel python2-setuptools @@ -41,9 +40,6 @@ install --directory %%{buildroot}%{_datadir}/udica/templates install --directory %{buildroot}%{_mandir}/man8 install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 -%check -make test - %files %{_mandir}/man8/udica.8* %{_bindir}/udica From cdec489222b40e5753cddfda303824178faf14b1 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 4 Jun 2021 21:18:38 +0200 Subject: [PATCH 43/80] Rebuilt for Python 3.10 --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index ebd5ce2..7ef1ff6 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.4 -Release: 3%{?dist} +Release: 4%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Jun 04 2021 Python Maint - 0.2.4-4 +- Rebuilt for Python 3.10 + * Wed Jan 27 2021 Fedora Release Engineering - 0.2.4-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From aa4e7af45386c5399350adadf8e304f27640340e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 19:55:18 +0000 Subject: [PATCH 44/80] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 7ef1ff6..c7b80b4 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.4 -Release: 4%{?dist} +Release: 5%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 0.2.4-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Fri Jun 04 2021 Python Maint - 0.2.4-4 - Rebuilt for Python 3.10 From 41b007ecf3f998804a59170a229497ff5c04bc80 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Mon, 27 Apr 2020 12:08:35 +0200 Subject: [PATCH 45/80] Update 'tests/sanity' to include more containers Sanity testcase generates SELinux policy just for one container "fedora:latest". Testcase should test generating SELinux policy also for Fedora Rawhide container, RHEL universal base image {7,8} and centos containers --- tests/sanity/runtest.sh | 66 ++++++++++++++++++++++------------------- 1 file changed, 35 insertions(+), 31 deletions(-) diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh index c8c5f34..fa1f802 100755 --- a/tests/sanity/runtest.sh +++ b/tests/sanity/runtest.sh @@ -30,6 +30,8 @@ PACKAGE="udica" +CONTAINERS="fedora:latest fedora:rawhide ubi8 ubi7 centos:8 centos:7" + rlJournalStart rlPhaseStartSetup rlAssertRpm "udica" @@ -43,44 +45,46 @@ rlJournalStart rlRun "PAGER=cat man udica" rlPhaseEnd - rlPhaseStartTest "Test basic scenario" - rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" - rlRun "podman ps | grep test" - rlRun "ps -efZ | grep bash" - rlRun "ps -efZ | grep bash | grep container_t" + for CONTAINER_NAME in ${CONTAINERS} ; do + rlPhaseStartTest "Test basic scenario for ${CONTAINER_NAME} container" + rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 ${CONTAINER_NAME}" + rlRun "podman ps | grep test" + rlRun "ps -efZ | grep bash" + rlRun "ps -efZ | grep bash | grep container_t" - rlRun "podman exec test ls /home" 1,2 - rlRun "podman exec test touch /var/spool/test" 1 - rlRun "podman exec test dnf install nmap-ncat -y" 0 - rlWatchdog "rlRun \"podman exec test nc -l 53\"" 3 + rlRun "podman exec test ls /home" 1,2 + rlRun "podman exec test touch /var/spool/test" 1 + rlRun "podman exec test yum install nmap-ncat -y" 0 + rlWatchdog "rlRun \"podman exec test nc -l 53\"" 3 - CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1) - rlRun "podman inspect $CONT_ID | udica my_container >$OUTPUT_FILE" - rlRun "podman stop test" - rlRun "podman rm --force test" + CONT_ID=$(podman ps | grep test | cut -d ' ' -f 1) + rlRun "podman inspect $CONT_ID | udica my_container >$OUTPUT_FILE" + rlRun "podman stop test" + rlRun "podman rm --force test" - rlRun "cat $OUTPUT_FILE" - rlAssertExists "my_container.cil" - SEMODULE=$(cat $OUTPUT_FILE | grep "semodule -i" | cut -d '#' -f 2) - rlRun "$SEMODULE" + rlRun "cat $OUTPUT_FILE" + rlAssertExists "my_container.cil" + SEMODULE=$(cat $OUTPUT_FILE | grep "semodule -i" | cut -d '#' -f 2) + rlRun "$SEMODULE" - PODMAN_OPT=$(cat $OUTPUT_FILE | grep "security-opt" | cut -d '"' -f 2) - rlRun "podman run -dit --name test2 $PODMAN_OPT -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" - rlRun "podman ps | grep test2" - rlRun "ps -efZ | grep bash" - rlRun "ps -efZ | grep bash | grep my_container.process" + PODMAN_OPT=$(cat $OUTPUT_FILE | grep "security-opt" | cut -d '"' -f 2) + rlRun "podman run -dit --name test2 $PODMAN_OPT -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" + rlRun "podman ps | grep test2" + rlRun "ps -efZ | grep bash" + rlRun "ps -efZ | grep bash | grep my_container.process" - rlRun "podman exec test2 ls /home" 0 - rlRun "podman exec test2 touch /var/spool/test" 0 - rlRun "podman exec test2 dnf install nmap-ncat -y" 0 - rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 2" 3 + rlRun "podman exec test2 ls /home" 0 + rlRun "podman exec test2 touch /var/spool/test" 0 + rlRun "podman exec test2 yum install nmap-ncat -y" 0 + rlWatchdog "rlRun \"podman exec test2 nc -l 53\" 2" 3 - rlRun "podman stop test2" - rlRun "podman rm --force test2" + rlRun "podman stop test2" + rlRun "podman rm --force test2" - rlRun "semodule -r my_container base_container net_container home_container" - rlRun "rm my_container.cil" - rlPhaseEnd + rlRun "semodule -r my_container base_container net_container home_container" + rlRun "rm my_container.cil" + rlPhaseEnd + done rlPhaseStartTest "Compare different ways of obtaining policy" rlRun "podman run -dit --name test -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 fedora" From c1190761ae41e29f9d887e84c9eb35dc0fa2573e Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 25 Aug 2021 13:19:03 +0200 Subject: [PATCH 46/80] udica-0.2.5-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.5 - Replace capability dictionary with str.lower() - Enable udica to generate policies with fifo class - Sort container inspect data before processing - Update templates to work properly with new cil parser --- .gitignore | 1 + ...-to-work-properly-with-new-cil-parse.patch | 381 ++++++++++++++++++ sources | 2 +- udica.spec | 12 +- 4 files changed, 393 insertions(+), 3 deletions(-) create mode 100644 0001-Update-templates-to-work-properly-with-new-cil-parse.patch diff --git a/.gitignore b/.gitignore index e27bbaa..42c7c98 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ /v0.2.2.tar.gz /v0.2.3.tar.gz /v0.2.4.tar.gz +/v0.2.5.tar.gz diff --git a/0001-Update-templates-to-work-properly-with-new-cil-parse.patch b/0001-Update-templates-to-work-properly-with-new-cil-parse.patch new file mode 100644 index 0000000..5d1ab67 --- /dev/null +++ b/0001-Update-templates-to-work-properly-with-new-cil-parse.patch @@ -0,0 +1,381 @@ +From 09bf6b339f1219769ada2c108c429013af19ceb5 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 26 Aug 2021 17:48:45 +0200 +Subject: [PATCH] Update templates to work properly with new cil parser + +Cil parser was recently updated to reject the following: +(block template1 (type t) ) +(block template2 (blockinherit template1)) +(block b (blockinherit template1) (blockinherit template2)) + +Re-declaration of type t +Previous declaration of type at /var/lib/selinux/targeted/tmp/modules/400/test/cil:1 +Failed to copy block contents into blockinherit +Failed to resolve AST +semodule: Failed! + +Remove (blockinherit container) from all templates so that "process" and +"socket" are only defined once (by inheriting "container" block in the +generated policy). +All allow rules referencing "process" and "socket" now need to be +enclosed in an optional block. + +While at it, unify indentation. + +Signed-off-by: Vit Mojzis +--- + udica/templates/config_container.cil | 33 ++++++++++--------- + udica/templates/home_container.cil | 48 +++++++++++++++------------- + udica/templates/log_container.cil | 44 +++++++++++++------------ + udica/templates/net_container.cil | 32 +++++++++---------- + udica/templates/tmp_container.cil | 18 +++++------ + udica/templates/tty_container.cil | 13 ++++---- + udica/templates/virt_container.cil | 20 ++++++------ + udica/templates/x_container.cil | 30 ++++++++--------- + 8 files changed, 120 insertions(+), 118 deletions(-) + +diff --git a/udica/templates/config_container.cil b/udica/templates/config_container.cil +index abd2c0e..6014f90 100644 +--- a/udica/templates/config_container.cil ++++ b/udica/templates/config_container.cil +@@ -1,25 +1,24 @@ + (block config_container +- (blockinherit container) +- +- (allow process configfile (dir (ioctl read getattr lock search open))) +- (allow process configfile (file (ioctl read getattr lock open))) +- (allow process configfile (lnk_file (read getattr))) +- ++ (optional config_container_optional ++ (allow process configfile (dir (ioctl read getattr lock search open))) ++ (allow process configfile (file (ioctl read getattr lock open))) ++ (allow process configfile (lnk_file (read getattr))) ++ ) + ) + + (block config_rw_container +- (blockinherit config_container) +- +- (allow process configfile (dir (ioctl read write getattr lock append open))) +- (allow process configfile (file (ioctl read write getattr lock append open))) +- (allow process configfile (lnk_file (ioctl read write getattr lock append open))) ++ (blockinherit config_container) ++ (optional config_rw_container_optional ++ (allow process configfile (dir (ioctl read write getattr lock append open))) ++ (allow process configfile (file (ioctl read write getattr lock append open))) ++ (allow process configfile (lnk_file (ioctl read write getattr lock append open))) ++ ) + ) + + (block config_manage_container +- (blockinherit container) +- +- (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) +- (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) +- (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) +- ++ (optional config_manage_container_optional ++ (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) ++ (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ ) + ) +diff --git a/udica/templates/home_container.cil b/udica/templates/home_container.cil +index 2683606..33499bc 100644 +--- a/udica/templates/home_container.cil ++++ b/udica/templates/home_container.cil +@@ -1,33 +1,37 @@ + (block home_container +- (blockinherit container) ++ (optional home_container_optional ++ (allow process process (capability (dac_override ))) + +- (allow process process (capability (dac_override ))) ++ (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) ++ (allow process home_root_t (dir (getattr search open read lock ioctl))) ++ (allow process user_home_t (dir (getattr search open read lock ioctl))) + +- (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) +- (allow process home_root_t (dir (getattr search open read lock ioctl))) +- (allow process user_home_t (dir (getattr search open read lock ioctl))) +- +- (allow process user_home_dir_t (file (getattr ioctl lock open read))) +- (allow process user_home_t (file (getattr ioctl lock open read))) ++ (allow process user_home_dir_t (file (getattr ioctl lock open read))) ++ (allow process user_home_t (file (getattr ioctl lock open read))) ++ ) + ) + + + (block home_rw_container +- (blockinherit home_container) +- (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) +- (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) +- (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) +- +- (allow process user_home_t (file (open getattr read write append ioctl lock))) +- (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) ++ (blockinherit home_container) ++ (optional home_rw_container_optional ++ (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) ++ (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) ++ (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) ++ ++ (allow process user_home_t (file (open getattr read write append ioctl lock))) ++ (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) ++ ) + ) + + (block home_manage_container +- (blockinherit home_rw_container) +- (allow process user_home_dir_t (dir (create unlink rename rmdir ))) +- (allow process home_root_t (dir (create unlink rename rmdir ))) +- (allow process user_home_t (dir (create unlink rename rmdir ))) +- +- (allow process user_home_t (file (create rename link unlink ))) +- (allow process user_home_dir_t (file (create rename link unlink ))) ++ (blockinherit home_rw_container) ++ (optional home_manage_container_optional ++ (allow process user_home_dir_t (dir (create unlink rename rmdir ))) ++ (allow process home_root_t (dir (create unlink rename rmdir ))) ++ (allow process user_home_t (dir (create unlink rename rmdir ))) ++ ++ (allow process user_home_t (file (create rename link unlink ))) ++ (allow process user_home_dir_t (file (create rename link unlink ))) ++ ) + ) +diff --git a/udica/templates/log_container.cil b/udica/templates/log_container.cil +index 767c669..a5ecf45 100644 +--- a/udica/templates/log_container.cil ++++ b/udica/templates/log_container.cil +@@ -1,31 +1,35 @@ + (block log_container +- (blockinherit container) +- +- (allow process var_t (dir (getattr search open))) +- (allow process logfile (dir (ioctl read getattr lock search open))) +- (allow process logfile (file (ioctl read getattr lock open map))) +- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) +- (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ (optional log_container_optional ++ (allow process var_t (dir (getattr search open))) ++ (allow process logfile (dir (ioctl read getattr lock search open))) ++ (allow process logfile (file (ioctl read getattr lock open map))) ++ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) ++ (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ ) + ) + + + (block log_rw_container +- (blockinherit log_container) ++ (blockinherit log_container) + +- (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) +- (allow process logfile (file (ioctl read write create getattr setattr lock append open))) +- (allow process logfile (lnk_file (ioctl read write getattr lock append open))) +- (allow process var_t (dir (getattr search open))) +- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) +- (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ (optional log_rw_container_optional ++ (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) ++ (allow process logfile (file (ioctl read write create getattr setattr lock append open))) ++ (allow process logfile (lnk_file (ioctl read write getattr lock append open))) ++ (allow process var_t (dir (getattr search open))) ++ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) ++ (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ ) + ) + + (block log_manage_container +- (blockinherit log_rw_container) ++ (blockinherit log_rw_container) + +- (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) +- (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) +- (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) +- (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) +- (allow process auditd_log_t (file (ioctl read write getattr lock open))) ++ (optional log_manage_container_optional ++ (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) ++ (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) ++ (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) ++ (allow process auditd_log_t (file (ioctl read write getattr lock open))) ++ ) + ) +diff --git a/udica/templates/net_container.cil b/udica/templates/net_container.cil +index f839ed3..a89d548 100644 +--- a/udica/templates/net_container.cil ++++ b/udica/templates/net_container.cil +@@ -1,25 +1,25 @@ + (block net_container +- (blockinherit container) +- (typeattributeset sandbox_net_domain (process)) ++ (optional net_container_optional ++ (typeattributeset sandbox_net_domain (process)) ++ ) + ) + + (block restricted_net_container +- (blockinherit container) ++ (optional restricted_net_container_optional ++ (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) ++ (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) ++ (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) + +- (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) +- (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) +- (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) ++ (allow process proc_t (lnk_file (read))) + +- (allow process proc_t (lnk_file (read))) ++ (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) ++ (allow process node_t (node (udp_recv recvfrom))) ++ (allow process node_t (node (udp_send sendto))) + +- (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) +- (allow process node_t (node (udp_recv recvfrom))) +- (allow process node_t (node (udp_send sendto))) ++ (allow process node_t (udp_socket (node_bind))) ++ (allow process node_t (tcp_socket (node_bind))) + +- (allow process node_t (udp_socket (node_bind))) +- (allow process node_t (tcp_socket (node_bind))) +- +- (allow process http_port_t (tcp_socket (name_connect))) +- (allow process http_port_t (tcp_socket (recv_msg send_msg))) ++ (allow process http_port_t (tcp_socket (name_connect))) ++ (allow process http_port_t (tcp_socket (recv_msg send_msg))) ++ ) + ) +- +diff --git a/udica/templates/tmp_container.cil b/udica/templates/tmp_container.cil +index 3b3e940..c2a899b 100644 +--- a/udica/templates/tmp_container.cil ++++ b/udica/templates/tmp_container.cil +@@ -1,15 +1,15 @@ + (block tmp_container +- (blockinherit container) +- +- (allow process tmpfile (dir (getattr search open))) +- (allow process tmpfile (file (ioctl read getattr lock open))) +- ++ (optional tmp_container_optional ++ (allow process tmpfile (dir (getattr search open))) ++ (allow process tmpfile (file (ioctl read getattr lock open))) ++ ) + ) + + (block tmp_rw_container +- (blockinherit tmp_container) +- +- (allow process tmpfile (file (ioctl read write getattr lock append open))) +- (allow process tmpfile (dir (ioctl read write getattr lock append open))) ++ (blockinherit tmp_container) + ++ (optional tmp_rw_container_optional ++ (allow process tmpfile (file (ioctl read write getattr lock append open))) ++ (allow process tmpfile (dir (ioctl read write getattr lock append open))) ++ ) + ) +diff --git a/udica/templates/tty_container.cil b/udica/templates/tty_container.cil +index 444b5f8..7a5522e 100644 +--- a/udica/templates/tty_container.cil ++++ b/udica/templates/tty_container.cil +@@ -1,10 +1,9 @@ + (block tty_container +- (blockinherit container) ++ (optional tty_container_optional ++ (allow process device_t (dir (getattr search open))) ++ (allow process device_t (dir (ioctl read getattr lock search open))) ++ (allow process device_t (lnk_file (read getattr))) + +- (allow process device_t (dir (getattr search open))) +- (allow process device_t (dir (ioctl read getattr lock search open))) +- (allow process device_t (lnk_file (read getattr))) +- +- (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) ++ (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) ++ ) + ) +- +diff --git a/udica/templates/virt_container.cil b/udica/templates/virt_container.cil +index 8ecae54..0728eba 100644 +--- a/udica/templates/virt_container.cil ++++ b/udica/templates/virt_container.cil +@@ -1,16 +1,14 @@ + (block virt_container +- (blockinherit container) ++ (optional virt_container_optional ++ (allow process var_t (dir (getattr search open))) ++ (allow process var_t (lnk_file (read getattr))) + +- (allow process var_t (dir (getattr search open))) +- (allow process var_t (lnk_file (read getattr))) ++ (allow process var_run_t (dir (getattr search open))) ++ (allow process var_run_t (lnk_file (read getattr))) + +- (allow process var_run_t (dir (getattr search open))) +- (allow process var_run_t (lnk_file (read getattr))) +- +- (allow process virt_var_run_t (dir (getattr search open))) +- (allow process virt_var_run_t (sock_file (write getattr append open))) +- +- (allow process virtd_t (unix_stream_socket (connectto))) ++ (allow process virt_var_run_t (dir (getattr search open))) ++ (allow process virt_var_run_t (sock_file (write getattr append open))) + ++ (allow process virtd_t (unix_stream_socket (connectto))) ++ ) + ) +- +diff --git a/udica/templates/x_container.cil b/udica/templates/x_container.cil +index ee7441e..0a6ddb9 100644 +--- a/udica/templates/x_container.cil ++++ b/udica/templates/x_container.cil +@@ -1,27 +1,25 @@ + (block x_container +- (blockinherit container) ++ (optional x_container_optional ++ (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) + +- (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) ++ (allow process xserver_t (unix_stream_socket (connectto))) + +- (allow process xserver_t (unix_stream_socket (connectto))) ++ (allow process device_t (dir (getattr search open))) + +- (allow process device_t (dir (getattr search open))) ++ (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) + +- (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) ++ (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) + +- (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) ++ (allow process urandom_device_t (chr_file (open read))) + +- (allow process urandom_device_t (chr_file (open read))) ++ (allow process tmpfs_t (dir (getattr search open))) + +- (allow process tmpfs_t (dir (getattr search open))) ++ (allow process tmp_t (dir (getattr search open))) ++ (allow process tmp_t (lnk_file (read getattr))) + +- (allow process tmp_t (dir (getattr search open))) +- (allow process tmp_t (lnk_file (read getattr))) +- +- (allow process xserver_tmp_t (dir (getattr search open))) +- (allow process xserver_tmp_t (sock_file (write getattr append open))) +- +- (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) ++ (allow process xserver_tmp_t (dir (getattr search open))) ++ (allow process xserver_tmp_t (sock_file (write getattr append open))) + ++ (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) ++ ) + ) +- +-- +2.30.2 + diff --git a/sources b/sources index 54ee37a..c04350e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.4.tar.gz) = 17d4d33939e15a113badf7df17b55c51cdf2659b49f6ae90c8e2f0b741ffabed019ee2b9a1dd8123f5ca96f3f1111fcad74d8480fdf00bc1b10b6e2d5f2948a4 +SHA512 (v0.2.5.tar.gz) = 6321442ea546a630e08d3dd007bab153e47e15dce821eb824a899b239aa9e00d0edc3a239d3da1c4161afc72147f20d372e34a399a195a4b4ade12049b10df57 diff --git a/udica.spec b/udica.spec index c7b80b4..c72c842 100644 --- a/udica.spec +++ b/udica.spec @@ -1,8 +1,9 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.4 -Release: 5%{?dist} +Version: 0.2.5 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz +Patch001: 0001-Update-templates-to-work-properly-with-new-cil-parse.patch License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica @@ -60,6 +61,13 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Aug 25 2021 Vit Mojzis - 0.2.5-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.5 +- Replace capability dictionary with str.lower() +- Enable udica to generate policies with fifo class +- Sort container inspect data before processing +- Update templates to work properly with new cil parser + * Fri Jul 23 2021 Fedora Release Engineering - 0.2.4-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 7ea190fa1ec9cf0df8ee91204dcee3477d87f8bf Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 14 Sep 2021 17:50:12 +0200 Subject: [PATCH 47/80] tests: Require container-selinux Policy templates where moved to container-selinux package and udica doesn't work properly without them. Sanity test temporarily needs git for downloading policy templates. Those will soon be available via container-selinux. Signed-off-by: Vit Mojzis --- tests/docker/runtest.sh | 1 + tests/sanity/runtest.sh | 1 + tests/tests.yml | 9 +++++++++ 3 files changed, 11 insertions(+) diff --git a/tests/docker/runtest.sh b/tests/docker/runtest.sh index c2290d5..1850b3c 100755 --- a/tests/docker/runtest.sh +++ b/tests/docker/runtest.sh @@ -33,6 +33,7 @@ PACKAGE="udica" rlJournalStart rlPhaseStartSetup rlAssertRpm "udica" + rlAssertRpm "container-selinux" rlAssertRpm "policycoreutils" rlAssertRpm "podman" rlAssertRpm "docker" diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh index fa1f802..1e9f188 100755 --- a/tests/sanity/runtest.sh +++ b/tests/sanity/runtest.sh @@ -35,6 +35,7 @@ CONTAINERS="fedora:latest fedora:rawhide ubi8 ubi7 centos:8 centos:7" rlJournalStart rlPhaseStartSetup rlAssertRpm "udica" + rlAssertRpm "container-selinux" rlAssertRpm "policycoreutils" rlAssertRpm "podman" OUTPUT_FILE=$(mktemp) diff --git a/tests/tests.yml b/tests/tests.yml index 42a2022..e8388b7 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -8,6 +8,8 @@ - role: standard-test-basic required_packages: - python3 + - container-selinux + - git tests: - smoke: dir: ./source @@ -16,6 +18,11 @@ dir: ./source run: python3 tests/test_integration.py +- hosts: localhost + tags: + - classic + - container + roles: - role: standard-test-beakerlib tags: - classic @@ -23,3 +30,5 @@ - sanity required_packages: - podman + - udica + - container-selinux From 4eba9fb5445937b4d67cbf3344b284b3ae28a952 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 13 Sep 2021 18:19:15 +0200 Subject: [PATCH 48/80] udica-0.2.6-1 - New release https://github.com/containers/udica/releases/tag/v0.2.6 - Move policy templates to container-selinux repo --- .gitignore | 1 + ...-to-work-properly-with-new-cil-parse.patch | 381 ------------------ sources | 2 +- udica.spec | 13 +- 4 files changed, 9 insertions(+), 388 deletions(-) delete mode 100644 0001-Update-templates-to-work-properly-with-new-cil-parse.patch diff --git a/.gitignore b/.gitignore index 42c7c98..389f6b5 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /v0.2.3.tar.gz /v0.2.4.tar.gz /v0.2.5.tar.gz +/v0.2.6.tar.gz diff --git a/0001-Update-templates-to-work-properly-with-new-cil-parse.patch b/0001-Update-templates-to-work-properly-with-new-cil-parse.patch deleted file mode 100644 index 5d1ab67..0000000 --- a/0001-Update-templates-to-work-properly-with-new-cil-parse.patch +++ /dev/null @@ -1,381 +0,0 @@ -From 09bf6b339f1219769ada2c108c429013af19ceb5 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 26 Aug 2021 17:48:45 +0200 -Subject: [PATCH] Update templates to work properly with new cil parser - -Cil parser was recently updated to reject the following: -(block template1 (type t) ) -(block template2 (blockinherit template1)) -(block b (blockinherit template1) (blockinherit template2)) - -Re-declaration of type t -Previous declaration of type at /var/lib/selinux/targeted/tmp/modules/400/test/cil:1 -Failed to copy block contents into blockinherit -Failed to resolve AST -semodule: Failed! - -Remove (blockinherit container) from all templates so that "process" and -"socket" are only defined once (by inheriting "container" block in the -generated policy). -All allow rules referencing "process" and "socket" now need to be -enclosed in an optional block. - -While at it, unify indentation. - -Signed-off-by: Vit Mojzis ---- - udica/templates/config_container.cil | 33 ++++++++++--------- - udica/templates/home_container.cil | 48 +++++++++++++++------------- - udica/templates/log_container.cil | 44 +++++++++++++------------ - udica/templates/net_container.cil | 32 +++++++++---------- - udica/templates/tmp_container.cil | 18 +++++------ - udica/templates/tty_container.cil | 13 ++++---- - udica/templates/virt_container.cil | 20 ++++++------ - udica/templates/x_container.cil | 30 ++++++++--------- - 8 files changed, 120 insertions(+), 118 deletions(-) - -diff --git a/udica/templates/config_container.cil b/udica/templates/config_container.cil -index abd2c0e..6014f90 100644 ---- a/udica/templates/config_container.cil -+++ b/udica/templates/config_container.cil -@@ -1,25 +1,24 @@ - (block config_container -- (blockinherit container) -- -- (allow process configfile (dir (ioctl read getattr lock search open))) -- (allow process configfile (file (ioctl read getattr lock open))) -- (allow process configfile (lnk_file (read getattr))) -- -+ (optional config_container_optional -+ (allow process configfile (dir (ioctl read getattr lock search open))) -+ (allow process configfile (file (ioctl read getattr lock open))) -+ (allow process configfile (lnk_file (read getattr))) -+ ) - ) - - (block config_rw_container -- (blockinherit config_container) -- -- (allow process configfile (dir (ioctl read write getattr lock append open))) -- (allow process configfile (file (ioctl read write getattr lock append open))) -- (allow process configfile (lnk_file (ioctl read write getattr lock append open))) -+ (blockinherit config_container) -+ (optional config_rw_container_optional -+ (allow process configfile (dir (ioctl read write getattr lock append open))) -+ (allow process configfile (file (ioctl read write getattr lock append open))) -+ (allow process configfile (lnk_file (ioctl read write getattr lock append open))) -+ ) - ) - - (block config_manage_container -- (blockinherit container) -- -- (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -- (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -- (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) -- -+ (optional config_manage_container_optional -+ (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -+ (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -+ (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) -+ ) - ) -diff --git a/udica/templates/home_container.cil b/udica/templates/home_container.cil -index 2683606..33499bc 100644 ---- a/udica/templates/home_container.cil -+++ b/udica/templates/home_container.cil -@@ -1,33 +1,37 @@ - (block home_container -- (blockinherit container) -+ (optional home_container_optional -+ (allow process process (capability (dac_override ))) - -- (allow process process (capability (dac_override ))) -+ (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) -+ (allow process home_root_t (dir (getattr search open read lock ioctl))) -+ (allow process user_home_t (dir (getattr search open read lock ioctl))) - -- (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) -- (allow process home_root_t (dir (getattr search open read lock ioctl))) -- (allow process user_home_t (dir (getattr search open read lock ioctl))) -- -- (allow process user_home_dir_t (file (getattr ioctl lock open read))) -- (allow process user_home_t (file (getattr ioctl lock open read))) -+ (allow process user_home_dir_t (file (getattr ioctl lock open read))) -+ (allow process user_home_t (file (getattr ioctl lock open read))) -+ ) - ) - - - (block home_rw_container -- (blockinherit home_container) -- (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -- (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -- (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -- -- (allow process user_home_t (file (open getattr read write append ioctl lock))) -- (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) -+ (blockinherit home_container) -+ (optional home_rw_container_optional -+ (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -+ (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -+ (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -+ -+ (allow process user_home_t (file (open getattr read write append ioctl lock))) -+ (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) -+ ) - ) - - (block home_manage_container -- (blockinherit home_rw_container) -- (allow process user_home_dir_t (dir (create unlink rename rmdir ))) -- (allow process home_root_t (dir (create unlink rename rmdir ))) -- (allow process user_home_t (dir (create unlink rename rmdir ))) -- -- (allow process user_home_t (file (create rename link unlink ))) -- (allow process user_home_dir_t (file (create rename link unlink ))) -+ (blockinherit home_rw_container) -+ (optional home_manage_container_optional -+ (allow process user_home_dir_t (dir (create unlink rename rmdir ))) -+ (allow process home_root_t (dir (create unlink rename rmdir ))) -+ (allow process user_home_t (dir (create unlink rename rmdir ))) -+ -+ (allow process user_home_t (file (create rename link unlink ))) -+ (allow process user_home_dir_t (file (create rename link unlink ))) -+ ) - ) -diff --git a/udica/templates/log_container.cil b/udica/templates/log_container.cil -index 767c669..a5ecf45 100644 ---- a/udica/templates/log_container.cil -+++ b/udica/templates/log_container.cil -@@ -1,31 +1,35 @@ - (block log_container -- (blockinherit container) -- -- (allow process var_t (dir (getattr search open))) -- (allow process logfile (dir (ioctl read getattr lock search open))) -- (allow process logfile (file (ioctl read getattr lock open map))) -- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -- (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ (optional log_container_optional -+ (allow process var_t (dir (getattr search open))) -+ (allow process logfile (dir (ioctl read getattr lock search open))) -+ (allow process logfile (file (ioctl read getattr lock open map))) -+ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -+ (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ ) - ) - - - (block log_rw_container -- (blockinherit log_container) -+ (blockinherit log_container) - -- (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) -- (allow process logfile (file (ioctl read write create getattr setattr lock append open))) -- (allow process logfile (lnk_file (ioctl read write getattr lock append open))) -- (allow process var_t (dir (getattr search open))) -- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -- (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ (optional log_rw_container_optional -+ (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) -+ (allow process logfile (file (ioctl read write create getattr setattr lock append open))) -+ (allow process logfile (lnk_file (ioctl read write getattr lock append open))) -+ (allow process var_t (dir (getattr search open))) -+ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -+ (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ ) - ) - - (block log_manage_container -- (blockinherit log_rw_container) -+ (blockinherit log_rw_container) - -- (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -- (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -- (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) -- (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) -- (allow process auditd_log_t (file (ioctl read write getattr lock open))) -+ (optional log_manage_container_optional -+ (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -+ (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -+ (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) -+ (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) -+ (allow process auditd_log_t (file (ioctl read write getattr lock open))) -+ ) - ) -diff --git a/udica/templates/net_container.cil b/udica/templates/net_container.cil -index f839ed3..a89d548 100644 ---- a/udica/templates/net_container.cil -+++ b/udica/templates/net_container.cil -@@ -1,25 +1,25 @@ - (block net_container -- (blockinherit container) -- (typeattributeset sandbox_net_domain (process)) -+ (optional net_container_optional -+ (typeattributeset sandbox_net_domain (process)) -+ ) - ) - - (block restricted_net_container -- (blockinherit container) -+ (optional restricted_net_container_optional -+ (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) -+ (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) -+ (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) - -- (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) -- (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) -- (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) -+ (allow process proc_t (lnk_file (read))) - -- (allow process proc_t (lnk_file (read))) -+ (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) -+ (allow process node_t (node (udp_recv recvfrom))) -+ (allow process node_t (node (udp_send sendto))) - -- (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) -- (allow process node_t (node (udp_recv recvfrom))) -- (allow process node_t (node (udp_send sendto))) -+ (allow process node_t (udp_socket (node_bind))) -+ (allow process node_t (tcp_socket (node_bind))) - -- (allow process node_t (udp_socket (node_bind))) -- (allow process node_t (tcp_socket (node_bind))) -- -- (allow process http_port_t (tcp_socket (name_connect))) -- (allow process http_port_t (tcp_socket (recv_msg send_msg))) -+ (allow process http_port_t (tcp_socket (name_connect))) -+ (allow process http_port_t (tcp_socket (recv_msg send_msg))) -+ ) - ) -- -diff --git a/udica/templates/tmp_container.cil b/udica/templates/tmp_container.cil -index 3b3e940..c2a899b 100644 ---- a/udica/templates/tmp_container.cil -+++ b/udica/templates/tmp_container.cil -@@ -1,15 +1,15 @@ - (block tmp_container -- (blockinherit container) -- -- (allow process tmpfile (dir (getattr search open))) -- (allow process tmpfile (file (ioctl read getattr lock open))) -- -+ (optional tmp_container_optional -+ (allow process tmpfile (dir (getattr search open))) -+ (allow process tmpfile (file (ioctl read getattr lock open))) -+ ) - ) - - (block tmp_rw_container -- (blockinherit tmp_container) -- -- (allow process tmpfile (file (ioctl read write getattr lock append open))) -- (allow process tmpfile (dir (ioctl read write getattr lock append open))) -+ (blockinherit tmp_container) - -+ (optional tmp_rw_container_optional -+ (allow process tmpfile (file (ioctl read write getattr lock append open))) -+ (allow process tmpfile (dir (ioctl read write getattr lock append open))) -+ ) - ) -diff --git a/udica/templates/tty_container.cil b/udica/templates/tty_container.cil -index 444b5f8..7a5522e 100644 ---- a/udica/templates/tty_container.cil -+++ b/udica/templates/tty_container.cil -@@ -1,10 +1,9 @@ - (block tty_container -- (blockinherit container) -+ (optional tty_container_optional -+ (allow process device_t (dir (getattr search open))) -+ (allow process device_t (dir (ioctl read getattr lock search open))) -+ (allow process device_t (lnk_file (read getattr))) - -- (allow process device_t (dir (getattr search open))) -- (allow process device_t (dir (ioctl read getattr lock search open))) -- (allow process device_t (lnk_file (read getattr))) -- -- (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) -+ (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) -+ ) - ) -- -diff --git a/udica/templates/virt_container.cil b/udica/templates/virt_container.cil -index 8ecae54..0728eba 100644 ---- a/udica/templates/virt_container.cil -+++ b/udica/templates/virt_container.cil -@@ -1,16 +1,14 @@ - (block virt_container -- (blockinherit container) -+ (optional virt_container_optional -+ (allow process var_t (dir (getattr search open))) -+ (allow process var_t (lnk_file (read getattr))) - -- (allow process var_t (dir (getattr search open))) -- (allow process var_t (lnk_file (read getattr))) -+ (allow process var_run_t (dir (getattr search open))) -+ (allow process var_run_t (lnk_file (read getattr))) - -- (allow process var_run_t (dir (getattr search open))) -- (allow process var_run_t (lnk_file (read getattr))) -- -- (allow process virt_var_run_t (dir (getattr search open))) -- (allow process virt_var_run_t (sock_file (write getattr append open))) -- -- (allow process virtd_t (unix_stream_socket (connectto))) -+ (allow process virt_var_run_t (dir (getattr search open))) -+ (allow process virt_var_run_t (sock_file (write getattr append open))) - -+ (allow process virtd_t (unix_stream_socket (connectto))) -+ ) - ) -- -diff --git a/udica/templates/x_container.cil b/udica/templates/x_container.cil -index ee7441e..0a6ddb9 100644 ---- a/udica/templates/x_container.cil -+++ b/udica/templates/x_container.cil -@@ -1,27 +1,25 @@ - (block x_container -- (blockinherit container) -+ (optional x_container_optional -+ (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) - -- (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) -+ (allow process xserver_t (unix_stream_socket (connectto))) - -- (allow process xserver_t (unix_stream_socket (connectto))) -+ (allow process device_t (dir (getattr search open))) - -- (allow process device_t (dir (getattr search open))) -+ (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) - -- (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) -+ (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) - -- (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) -+ (allow process urandom_device_t (chr_file (open read))) - -- (allow process urandom_device_t (chr_file (open read))) -+ (allow process tmpfs_t (dir (getattr search open))) - -- (allow process tmpfs_t (dir (getattr search open))) -+ (allow process tmp_t (dir (getattr search open))) -+ (allow process tmp_t (lnk_file (read getattr))) - -- (allow process tmp_t (dir (getattr search open))) -- (allow process tmp_t (lnk_file (read getattr))) -- -- (allow process xserver_tmp_t (dir (getattr search open))) -- (allow process xserver_tmp_t (sock_file (write getattr append open))) -- -- (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) -+ (allow process xserver_tmp_t (dir (getattr search open))) -+ (allow process xserver_tmp_t (sock_file (write getattr append open))) - -+ (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) -+ ) - ) -- --- -2.30.2 - diff --git a/sources b/sources index c04350e..b0e6d67 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.5.tar.gz) = 6321442ea546a630e08d3dd007bab153e47e15dce821eb824a899b239aa9e00d0edc3a239d3da1c4161afc72147f20d372e34a399a195a4b4ade12049b10df57 +SHA512 (v0.2.6.tar.gz) = 29295c9d95ecb15aed7e226d92a0b838046cf607e98956c66a83ad0f4ddf58b255586c24d407216ae9ddf5b11f502ae2b3a6822208d8dc8141124e68dac19265 diff --git a/udica.spec b/udica.spec index c72c842..aa0c726 100644 --- a/udica.spec +++ b/udica.spec @@ -1,9 +1,8 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.5 +Version: 0.2.6 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz -Patch001: 0001-Update-templates-to-work-properly-with-new-cil-parse.patch License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica @@ -14,6 +13,8 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif +# container-selinux provides policy templates +Requires: container-selinux >= 2.168.0-2 %description Tool for generating SELinux security profiles for containers based on @@ -30,8 +31,6 @@ inspection of container JSON file. %endif %install -install --directory %%{buildroot}%{_datadir}/udica/templates - %if 0%{?fedora} || 0%{?rhel} > 7 %{__python3} setup.py install --single-version-externally-managed --root=%{buildroot} %else @@ -46,9 +45,7 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %{_bindir}/udica %dir %{_datadir}/udica %dir %{_datadir}/udica/ansible -%dir %{_datadir}/udica/templates %{_datadir}/udica/ansible/* -%{_datadir}/udica/templates/* %if 0%{?fedora} || 0%{?rhel} > 7 %license LICENSE @@ -61,6 +58,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Sep 13 2021 Vit Mojzis - 0.2.6-1 +- New release https://github.com/containers/udica/releases/tag/v0.2.6 +- Move policy templates to container-selinux repo + * Wed Aug 25 2021 Vit Mojzis - 0.2.5-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.5 - Replace capability dictionary with str.lower() From f42dfe4da4a44212c155ad0da9e46242870d237a Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 11 Nov 2021 18:12:46 +0100 Subject: [PATCH 49/80] udica-0.2.6-2 - Make sure each section of the inspect exists before accessing Fixes: https://github.com/containers/udica/issues/103 https://github.com/containers/udica/issues/105 --- ...ection-of-the-inspect-exists-before-.patch | 133 ++++++++++++++++++ udica.spec | 6 +- 2 files changed, 138 insertions(+), 1 deletion(-) create mode 100644 0001-Make-sure-each-section-of-the-inspect-exists-before-.patch diff --git a/0001-Make-sure-each-section-of-the-inspect-exists-before-.patch b/0001-Make-sure-each-section-of-the-inspect-exists-before-.patch new file mode 100644 index 0000000..aed4008 --- /dev/null +++ b/0001-Make-sure-each-section-of-the-inspect-exists-before-.patch @@ -0,0 +1,133 @@ +From dd05dbe742384dd22f4a63889c56cb75e4e2f571 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Tue, 9 Nov 2021 18:04:39 +0100 +Subject: [PATCH] Make sure each section of the inspect exists before accessing + +Fixes: https://github.com/containers/udica/issues/105, + https://github.com/containers/udica/issues/103 + +Inspired by: +https://github.com/WellIDKRealy/udica/commit/0c56d98b8c58a8a4ceb89b04d700c834c13778fd + +Signed-off-by: Vit Mojzis +--- + udica/parse.py | 62 ++++++++++++++++++++++++++++++++++++++------------ + 1 file changed, 48 insertions(+), 14 deletions(-) + +diff --git a/udica/parse.py b/udica/parse.py +index 0797095..59b3dc5 100644 +--- a/udica/parse.py ++++ b/udica/parse.py +@@ -29,6 +29,24 @@ ENGINE_DOCKER = "docker" + ENGINE_ALL = [ENGINE_PODMAN, ENGINE_CRIO, ENGINE_DOCKER] + + ++# Decorator for verifying that getting value from "data" won't ++# result in Key error or Type error ++# e.g. in data[0]["HostConfig"]["Devices"] ++# missing "HostConfig" key in data[0] produces KeyError and ++# data[0]["HostConfig"] == none produces TypeError ++def getter_decorator(function): ++ # Verify that each element in path exists and return the corresponding value, ++ # otherwise return [] -- can be safely processed by iterators ++ def wrapper(self, data, *args): ++ try: ++ value = function(self, data, *args) ++ return value if value else [] ++ except (KeyError, TypeError): ++ return [] ++ ++ return wrapper ++ ++ + def json_is_podman_or_docker_format(json_rep): + """Check if the inspected file is in a format from docker or podman. + +@@ -91,19 +109,22 @@ class EngineHelper(abc.ABC): + + def get_caps(self, data, opts): + if opts["Caps"]: +- if opts["Caps"] == "None": ++ if opts["Caps"] in ["None", "none"]: + return [] + return opts["Caps"].split(",") + return [] + + + class PodmanDockerHelper(EngineHelper): ++ @getter_decorator + def get_devices(self, data): + return data[0]["HostConfig"]["Devices"] + ++ @getter_decorator + def get_mounts(self, data): + return data[0]["Mounts"] + ++ @getter_decorator + def get_ports(self, data): + ports = [] + for key, value in data[0]["NetworkSettings"]["Ports"].items(): +@@ -120,8 +141,13 @@ class PodmanHelper(PodmanDockerHelper): + def __init__(self): + super().__init__(ENGINE_PODMAN) + ++ @getter_decorator + def get_caps(self, data, opts): +- if not opts["Caps"]: ++ if opts["Caps"]: ++ return ( ++ opts["Caps"].split(",") if opts["Caps"] not in ["None", "none"] else [] ++ ) ++ else: + return data[0]["EffectiveCaps"] + return [] + +@@ -138,18 +164,25 @@ class DockerHelper(PodmanDockerHelper): + def adjust_json_from_docker(self, json_rep): + """If the json comes from a docker call, we need to adjust it to make use + of it.""" +- +- if not isinstance(json_rep[0]["NetworkSettings"]["Ports"], dict): +- raise Exception( +- "Error parsing docker engine inspection JSON structure, try to specify container engine using '--container-engine' parameter" +- ) +- +- for item in json_rep[0]["Mounts"]: +- item["source"] = item["Source"] +- if item["Mode"] == "rw": +- item["options"] = "rw" +- if item["Mode"] == "ro": +- item["options"] = "ro" ++ try: ++ if not isinstance(json_rep[0]["NetworkSettings"]["Ports"], dict): ++ raise Exception( ++ "Error parsing docker engine inspection JSON structure, try to specify container engine using '--container-engine' parameter" ++ ) ++ except (KeyError, TypeError): ++ # "Ports" not specified in given json file ++ pass ++ ++ try: ++ for item in json_rep[0]["Mounts"]: ++ item["source"] = item["Source"] ++ if item["Mode"] == "rw": ++ item["options"] = "rw" ++ if item["Mode"] == "ro": ++ item["options"] = "ro" ++ except (KeyError, TypeError): ++ # "Mounts" not specified in given json file ++ pass + + + class CrioHelper(EngineHelper): +@@ -161,6 +194,7 @@ class CrioHelper(EngineHelper): + # bind mounting device on the container + return [] + ++ @getter_decorator + def get_mounts(self, data): + return data["status"]["mounts"] + +-- +2.30.2 + diff --git a/udica.spec b/udica.spec index aa0c726..1acaf91 100644 --- a/udica.spec +++ b/udica.spec @@ -1,8 +1,9 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.6 -Release: 1%{?dist} +Release: 2%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz +Patch0: 0001-Make-sure-each-section-of-the-inspect-exists-before-.patch License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica @@ -58,6 +59,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Thu Nov 11 2021 Vit Mojzis - 0.2.6-2 +- Make sure each section of the inspect exists before accessing + * Mon Sep 13 2021 Vit Mojzis - 0.2.6-1 - New release https://github.com/containers/udica/releases/tag/v0.2.6 - Move policy templates to container-selinux repo From e10e896cd4877fe9bffc2837fae5695f62b211a7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jan 2022 03:24:15 +0000 Subject: [PATCH 50/80] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 1acaf91..79f52c5 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.6 -Release: 2%{?dist} +Release: 3%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz Patch0: 0001-Make-sure-each-section-of-the-inspect-exists-before-.patch License: GPLv3+ @@ -59,6 +59,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sat Jan 22 2022 Fedora Release Engineering - 0.2.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Thu Nov 11 2021 Vit Mojzis - 0.2.6-2 - Make sure each section of the inspect exists before accessing From d433a427be31af9b4185ee1708043e72e5c42b36 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 10 Feb 2022 13:42:16 +0100 Subject: [PATCH 51/80] tests/Sanity: Use centos-stream 8 container CentOS-8 is EOL. Fixes: :: [ 08:38:17 ] :: [ BEGIN ] :: Running 'podman exec test yum install nmap-ncat -y' CentOS Linux 8 - AppStream 31 B/s | 38 B 00:01 Error: Failed to download metadata for repo 'appstream': Cannot prepare internal mirrorlist: No URLs in mirrorlist --- tests/sanity/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh index 1e9f188..260add0 100755 --- a/tests/sanity/runtest.sh +++ b/tests/sanity/runtest.sh @@ -30,7 +30,7 @@ PACKAGE="udica" -CONTAINERS="fedora:latest fedora:rawhide ubi8 ubi7 centos:8 centos:7" +CONTAINERS="fedora:latest fedora:rawhide ubi8 ubi7 centos:stream8 centos:7" rlJournalStart rlPhaseStartSetup From 1d04ad9053e1b9e8464cb80de0064fb609ae87a0 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 2 May 2022 15:59:53 +0200 Subject: [PATCH 52/80] udica-0.2.6-4 - Improve label collection for mounts and devices Fixes: https://github.com/containers/udica/issues/98 https://github.com/containers/udica/issues/109 --- ...el-collection-for-mounts-and-devices.patch | 54 +++++++++++++++++++ udica.spec | 8 ++- 2 files changed, 60 insertions(+), 2 deletions(-) create mode 100644 0002-Improve-label-collection-for-mounts-and-devices.patch diff --git a/0002-Improve-label-collection-for-mounts-and-devices.patch b/0002-Improve-label-collection-for-mounts-and-devices.patch new file mode 100644 index 0000000..d8ab991 --- /dev/null +++ b/0002-Improve-label-collection-for-mounts-and-devices.patch @@ -0,0 +1,54 @@ +From 2e1f70537bf556a0f2238104e4fb3cf8518fcfc4 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 29 Apr 2022 16:15:06 +0200 +Subject: [PATCH] Improve label collection for mounts and devices + +Catch exception triggered by selabel_lookup when it encounters file +context definition containing "<>" + +Real label of given path may differ from what selable_lookup +(matchpathcon) returns. Udica should allow access to both. + +Fixes: + https://github.com/containers/udica/issues/98 + https://github.com/containers/udica/issues/109 +--- + udica/policy.py | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/udica/policy.py b/udica/policy.py +index 07d957c..1d53e2a 100644 +--- a/udica/policy.py ++++ b/udica/policy.py +@@ -67,12 +67,23 @@ def list_contexts(directory): + contexts.append(semanage.semanage_context_get_type(context)) + + selabel = selinux.selabel_open(selinux.SELABEL_CTX_FILE, None, 0) +- (rc, context) = selinux.selabel_lookup(selabel, directory, 0) +- if context == None: +- if exists(directory) == False: +- exit(1) ++ try: ++ (rc, context) = selinux.selabel_lookup(selabel, directory, 0) ++ except FileNotFoundError: ++ # File context definition containing "<>" triggers exception ++ context = None ++ if context: ++ contexts.append(context.split(":")[2]) ++ ++ # Get the real label (ls -lZ) - may differ from what selabel_lookup returns ++ try: + context = selinux.getfilecon(directory)[1] +- contexts.append(context.split(":")[2]) ++ except FileNotFoundError: ++ context = None ++ ++ if context: ++ contexts.append(context.split(":")[2]) ++ + return contexts + + +-- +2.35.1 + diff --git a/udica.spec b/udica.spec index 79f52c5..e108ede 100644 --- a/udica.spec +++ b/udica.spec @@ -1,9 +1,10 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.6 -Release: 3%{?dist} +Release: 4%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz -Patch0: 0001-Make-sure-each-section-of-the-inspect-exists-before-.patch +Patch0001: 0001-Make-sure-each-section-of-the-inspect-exists-before-.patch +Patch0002: 0002-Improve-label-collection-for-mounts-and-devices.patch License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica @@ -59,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon May 02 2022 Vit Mojzis - 0.2.6-4 +- Improve label collection for mounts and devices + * Sat Jan 22 2022 Fedora Release Engineering - 0.2.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From b78fa640422b1174a247a67eefe045cd9d1629ed Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 13 Jun 2022 15:42:40 +0200 Subject: [PATCH 53/80] Rebuilt for Python 3.11 --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index e108ede..53cd078 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.6 -Release: 4%{?dist} +Release: 5%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz Patch0001: 0001-Make-sure-each-section-of-the-inspect-exists-before-.patch Patch0002: 0002-Improve-label-collection-for-mounts-and-devices.patch @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Jun 13 2022 Python Maint - 0.2.6-5 +- Rebuilt for Python 3.11 + * Mon May 02 2022 Vit Mojzis - 0.2.6-4 - Improve label collection for mounts and devices From 879af9f4ccd1341477e71a759d8a6fbe5682373f Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 22 Jun 2022 14:03:02 +0200 Subject: [PATCH 54/80] udica-0.2.7 New release https://github.com/containers/udica/releases/tag/v0.2.7 - Add support for containerd via "nerdctl inspect" - Avoid duplicate rules for accessing mounts and devices Fixes: https://github.com/containers/udica/issues/90 https://github.com/containers/udica/issues/7 Related: https://github.com/containers/udica/issues/84 --- .gitignore | 1 + ...ection-of-the-inspect-exists-before-.patch | 133 ------------------ ...el-collection-for-mounts-and-devices.patch | 54 ------- sources | 2 +- udica.spec | 10 +- 5 files changed, 8 insertions(+), 192 deletions(-) delete mode 100644 0001-Make-sure-each-section-of-the-inspect-exists-before-.patch delete mode 100644 0002-Improve-label-collection-for-mounts-and-devices.patch diff --git a/.gitignore b/.gitignore index 389f6b5..8b13f70 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,4 @@ /v0.2.4.tar.gz /v0.2.5.tar.gz /v0.2.6.tar.gz +/v0.2.7.tar.gz diff --git a/0001-Make-sure-each-section-of-the-inspect-exists-before-.patch b/0001-Make-sure-each-section-of-the-inspect-exists-before-.patch deleted file mode 100644 index aed4008..0000000 --- a/0001-Make-sure-each-section-of-the-inspect-exists-before-.patch +++ /dev/null @@ -1,133 +0,0 @@ -From dd05dbe742384dd22f4a63889c56cb75e4e2f571 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Tue, 9 Nov 2021 18:04:39 +0100 -Subject: [PATCH] Make sure each section of the inspect exists before accessing - -Fixes: https://github.com/containers/udica/issues/105, - https://github.com/containers/udica/issues/103 - -Inspired by: -https://github.com/WellIDKRealy/udica/commit/0c56d98b8c58a8a4ceb89b04d700c834c13778fd - -Signed-off-by: Vit Mojzis ---- - udica/parse.py | 62 ++++++++++++++++++++++++++++++++++++++------------ - 1 file changed, 48 insertions(+), 14 deletions(-) - -diff --git a/udica/parse.py b/udica/parse.py -index 0797095..59b3dc5 100644 ---- a/udica/parse.py -+++ b/udica/parse.py -@@ -29,6 +29,24 @@ ENGINE_DOCKER = "docker" - ENGINE_ALL = [ENGINE_PODMAN, ENGINE_CRIO, ENGINE_DOCKER] - - -+# Decorator for verifying that getting value from "data" won't -+# result in Key error or Type error -+# e.g. in data[0]["HostConfig"]["Devices"] -+# missing "HostConfig" key in data[0] produces KeyError and -+# data[0]["HostConfig"] == none produces TypeError -+def getter_decorator(function): -+ # Verify that each element in path exists and return the corresponding value, -+ # otherwise return [] -- can be safely processed by iterators -+ def wrapper(self, data, *args): -+ try: -+ value = function(self, data, *args) -+ return value if value else [] -+ except (KeyError, TypeError): -+ return [] -+ -+ return wrapper -+ -+ - def json_is_podman_or_docker_format(json_rep): - """Check if the inspected file is in a format from docker or podman. - -@@ -91,19 +109,22 @@ class EngineHelper(abc.ABC): - - def get_caps(self, data, opts): - if opts["Caps"]: -- if opts["Caps"] == "None": -+ if opts["Caps"] in ["None", "none"]: - return [] - return opts["Caps"].split(",") - return [] - - - class PodmanDockerHelper(EngineHelper): -+ @getter_decorator - def get_devices(self, data): - return data[0]["HostConfig"]["Devices"] - -+ @getter_decorator - def get_mounts(self, data): - return data[0]["Mounts"] - -+ @getter_decorator - def get_ports(self, data): - ports = [] - for key, value in data[0]["NetworkSettings"]["Ports"].items(): -@@ -120,8 +141,13 @@ class PodmanHelper(PodmanDockerHelper): - def __init__(self): - super().__init__(ENGINE_PODMAN) - -+ @getter_decorator - def get_caps(self, data, opts): -- if not opts["Caps"]: -+ if opts["Caps"]: -+ return ( -+ opts["Caps"].split(",") if opts["Caps"] not in ["None", "none"] else [] -+ ) -+ else: - return data[0]["EffectiveCaps"] - return [] - -@@ -138,18 +164,25 @@ class DockerHelper(PodmanDockerHelper): - def adjust_json_from_docker(self, json_rep): - """If the json comes from a docker call, we need to adjust it to make use - of it.""" -- -- if not isinstance(json_rep[0]["NetworkSettings"]["Ports"], dict): -- raise Exception( -- "Error parsing docker engine inspection JSON structure, try to specify container engine using '--container-engine' parameter" -- ) -- -- for item in json_rep[0]["Mounts"]: -- item["source"] = item["Source"] -- if item["Mode"] == "rw": -- item["options"] = "rw" -- if item["Mode"] == "ro": -- item["options"] = "ro" -+ try: -+ if not isinstance(json_rep[0]["NetworkSettings"]["Ports"], dict): -+ raise Exception( -+ "Error parsing docker engine inspection JSON structure, try to specify container engine using '--container-engine' parameter" -+ ) -+ except (KeyError, TypeError): -+ # "Ports" not specified in given json file -+ pass -+ -+ try: -+ for item in json_rep[0]["Mounts"]: -+ item["source"] = item["Source"] -+ if item["Mode"] == "rw": -+ item["options"] = "rw" -+ if item["Mode"] == "ro": -+ item["options"] = "ro" -+ except (KeyError, TypeError): -+ # "Mounts" not specified in given json file -+ pass - - - class CrioHelper(EngineHelper): -@@ -161,6 +194,7 @@ class CrioHelper(EngineHelper): - # bind mounting device on the container - return [] - -+ @getter_decorator - def get_mounts(self, data): - return data["status"]["mounts"] - --- -2.30.2 - diff --git a/0002-Improve-label-collection-for-mounts-and-devices.patch b/0002-Improve-label-collection-for-mounts-and-devices.patch deleted file mode 100644 index d8ab991..0000000 --- a/0002-Improve-label-collection-for-mounts-and-devices.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 2e1f70537bf556a0f2238104e4fb3cf8518fcfc4 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Fri, 29 Apr 2022 16:15:06 +0200 -Subject: [PATCH] Improve label collection for mounts and devices - -Catch exception triggered by selabel_lookup when it encounters file -context definition containing "<>" - -Real label of given path may differ from what selable_lookup -(matchpathcon) returns. Udica should allow access to both. - -Fixes: - https://github.com/containers/udica/issues/98 - https://github.com/containers/udica/issues/109 ---- - udica/policy.py | 21 ++++++++++++++++----- - 1 file changed, 16 insertions(+), 5 deletions(-) - -diff --git a/udica/policy.py b/udica/policy.py -index 07d957c..1d53e2a 100644 ---- a/udica/policy.py -+++ b/udica/policy.py -@@ -67,12 +67,23 @@ def list_contexts(directory): - contexts.append(semanage.semanage_context_get_type(context)) - - selabel = selinux.selabel_open(selinux.SELABEL_CTX_FILE, None, 0) -- (rc, context) = selinux.selabel_lookup(selabel, directory, 0) -- if context == None: -- if exists(directory) == False: -- exit(1) -+ try: -+ (rc, context) = selinux.selabel_lookup(selabel, directory, 0) -+ except FileNotFoundError: -+ # File context definition containing "<>" triggers exception -+ context = None -+ if context: -+ contexts.append(context.split(":")[2]) -+ -+ # Get the real label (ls -lZ) - may differ from what selabel_lookup returns -+ try: - context = selinux.getfilecon(directory)[1] -- contexts.append(context.split(":")[2]) -+ except FileNotFoundError: -+ context = None -+ -+ if context: -+ contexts.append(context.split(":")[2]) -+ - return contexts - - --- -2.35.1 - diff --git a/sources b/sources index b0e6d67..a1cf679 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.6.tar.gz) = 29295c9d95ecb15aed7e226d92a0b838046cf607e98956c66a83ad0f4ddf58b255586c24d407216ae9ddf5b11f502ae2b3a6822208d8dc8141124e68dac19265 +SHA512 (v0.2.7.tar.gz) = 03ff95f80317d09f980f89a7c415f0aeb6de965e64e9179969d2361d6a62ad243987e0355453a2c4ce4f4086834ea651644ccaa7eff1d82926000373040fa21d diff --git a/udica.spec b/udica.spec index 53cd078..dd87425 100644 --- a/udica.spec +++ b/udica.spec @@ -1,10 +1,8 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.6 -Release: 5%{?dist} +Version: 0.2.7 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz -Patch0001: 0001-Make-sure-each-section-of-the-inspect-exists-before-.patch -Patch0002: 0002-Improve-label-collection-for-mounts-and-devices.patch License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica @@ -60,6 +58,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Jun 22 2022 Vit Mojzis - 0.2.7-1 +- Add support for containerd via "nerdctl inspect" +- Avoid duplicate rules for accessing mounts and devices + * Mon Jun 13 2022 Python Maint - 0.2.6-5 - Rebuilt for Python 3.11 From 91cdda68b3c6948db2bfa159b5fb98ed4840f818 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 11:15:52 +0000 Subject: [PATCH 55/80] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index dd87425..53b2b86 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.7 -Release: 1%{?dist} +Release: 2%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -58,6 +58,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 0.2.7-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Wed Jun 22 2022 Vit Mojzis - 0.2.7-1 - Add support for containerd via "nerdctl inspect" - Avoid duplicate rules for accessing mounts and devices From ad353df40cf83d230649dc86d9c6ddac602af8ac Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 21 Oct 2022 15:23:51 +0200 Subject: [PATCH 56/80] udica-0.2.7-3 - Add --devices option Fixes: https://github.com/containers/udica/issues/110 --- 0001-Add-device-access-option.patch | 49 +++ 0002-Syntax-changes-after-running-black.patch | 47 +++ 0003-Add-unit-test-for-device-access.patch | 294 ++++++++++++++++++ 0004-Rename-device-access-to-devices.patch | 101 ++++++ udica.spec | 9 +- 5 files changed, 499 insertions(+), 1 deletion(-) create mode 100644 0001-Add-device-access-option.patch create mode 100644 0002-Syntax-changes-after-running-black.patch create mode 100644 0003-Add-unit-test-for-device-access.patch create mode 100644 0004-Rename-device-access-to-devices.patch diff --git a/0001-Add-device-access-option.patch b/0001-Add-device-access-option.patch new file mode 100644 index 0000000..0770609 --- /dev/null +++ b/0001-Add-device-access-option.patch @@ -0,0 +1,49 @@ +From a72b8fffc82657de85d20b3c9191d24a0b41e612 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Martin=20Sk=C3=B8tt?= +Date: Thu, 11 Aug 2022 14:20:14 +0200 +Subject: [PATCH 1/4] Add ---device--access option +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Martin Skøtt +--- + udica/__main__.py | 8 ++++++++ + udica/policy.py | 2 ++ + 2 files changed, 10 insertions(+) + +diff --git a/udica/__main__.py b/udica/__main__.py +index d72a4b4..9cb276d 100644 +--- a/udica/__main__.py ++++ b/udica/__main__.py +@@ -127,6 +127,14 @@ def get_args(): + required=False, + default="-", + ) ++ parser.add_argument( ++ "--device-access", ++ help='List of devices the container should have access to, e.g "--device-access /dev/dri/card0,/dev/dri/renderD128"', ++ required=False, ++ default=None, ++ type=str, ++ dest='DeviceAccess' ++ ) + args = parser.parse_args() + return vars(args) + +diff --git a/udica/policy.py b/udica/policy.py +index ec6ce20..0f1145a 100644 +--- a/udica/policy.py ++++ b/udica/policy.py +@@ -173,6 +173,8 @@ def create_policy( + # devices + # Not applicable for CRI-O container engine + if inspect_format != "CRI-0": ++ if (not devices and opts["DeviceAccess"]): ++ devices = [{"PathOnHost": device} for device in opts["DeviceAccess"].split(',')] + write_policy_for_podman_devices(devices, policy) + + # mounts +-- +2.37.3 + diff --git a/0002-Syntax-changes-after-running-black.patch b/0002-Syntax-changes-after-running-black.patch new file mode 100644 index 0000000..9571da0 --- /dev/null +++ b/0002-Syntax-changes-after-running-black.patch @@ -0,0 +1,47 @@ +From a2f0e4588e010e9df9da7bbd46fa4304335f9b25 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Martin=20Sk=C3=B8tt?= +Date: Thu, 11 Aug 2022 20:29:18 +0200 +Subject: [PATCH 2/4] Syntax changes after running black +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Martin Skøtt +--- + udica/__main__.py | 2 +- + udica/policy.py | 6 ++++-- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/udica/__main__.py b/udica/__main__.py +index 9cb276d..84e0ba4 100644 +--- a/udica/__main__.py ++++ b/udica/__main__.py +@@ -133,7 +133,7 @@ def get_args(): + required=False, + default=None, + type=str, +- dest='DeviceAccess' ++ dest="DeviceAccess", + ) + args = parser.parse_args() + return vars(args) +diff --git a/udica/policy.py b/udica/policy.py +index 0f1145a..9b7a14f 100644 +--- a/udica/policy.py ++++ b/udica/policy.py +@@ -173,8 +173,10 @@ def create_policy( + # devices + # Not applicable for CRI-O container engine + if inspect_format != "CRI-0": +- if (not devices and opts["DeviceAccess"]): +- devices = [{"PathOnHost": device} for device in opts["DeviceAccess"].split(',')] ++ if not devices and opts["DeviceAccess"]: ++ devices = [ ++ {"PathOnHost": device} for device in opts["DeviceAccess"].split(",") ++ ] + write_policy_for_podman_devices(devices, policy) + + # mounts +-- +2.37.3 + diff --git a/0003-Add-unit-test-for-device-access.patch b/0003-Add-unit-test-for-device-access.patch new file mode 100644 index 0000000..321a9b8 --- /dev/null +++ b/0003-Add-unit-test-for-device-access.patch @@ -0,0 +1,294 @@ +From 0d3e3194e26a21c531d13bde5e45c0bce9717a99 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Martin=20Sk=C3=B8tt?= +Date: Thu, 11 Aug 2022 21:50:57 +0200 +Subject: [PATCH 3/4] Add unit test for --device-access +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Martin Skøtt +--- + tests/test_device_access.podman.json | 244 +++++++++++++++++++++++++++ + tests/test_main.py | 15 ++ + 2 files changed, 259 insertions(+) + create mode 100644 tests/test_device_access.podman.json + +diff --git a/tests/test_device_access.podman.json b/tests/test_device_access.podman.json +new file mode 100644 +index 0000000..9a806a2 +--- /dev/null ++++ b/tests/test_device_access.podman.json +@@ -0,0 +1,244 @@ ++[ ++ { ++ "Id": "68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744", ++ "Created": "2022-08-11T20:54:51.026287311+02:00", ++ "Path": "/bin/bash", ++ "Args": [ ++ "/bin/bash" ++ ], ++ "State": { ++ "OciVersion": "1.0.2-dev", ++ "Status": "exited", ++ "Running": false, ++ "Paused": false, ++ "Restarting": false, ++ "OOMKilled": false, ++ "Dead": false, ++ "Pid": 0, ++ "ExitCode": 0, ++ "Error": "", ++ "StartedAt": "2022-08-11T20:54:51.116938836+02:00", ++ "FinishedAt": "2022-08-11T20:54:51.1327839+02:00", ++ "Health": { ++ "Status": "", ++ "FailingStreak": 0, ++ "Log": null ++ }, ++ "CheckpointedAt": "0001-01-01T00:00:00Z", ++ "RestoredAt": "0001-01-01T00:00:00Z" ++ }, ++ "Image": "2ecb6df959942dd2fdeb65606ca2e42a54f8c06af10eeb594fdfc3e2656c53d1", ++ "ImageName": "registry.fedoraproject.org/fedora:latest", ++ "Rootfs": "", ++ "Pod": "", ++ "ResolvConfPath": "/run/user/1000/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/resolv.conf", ++ "HostnamePath": "/run/user/1000/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/hostname", ++ "HostsPath": "/run/user/1000/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/hosts", ++ "StaticDir": "/home/martin/.local/share/containers/storage/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata", ++ "OCIConfigPath": "/home/martin/.local/share/containers/storage/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/config.json", ++ "OCIRuntime": "crun", ++ "ConmonPidFile": "/run/user/1000/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/conmon.pid", ++ "PidFile": "/run/user/1000/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/pidfile", ++ "Name": "charming_khorana", ++ "RestartCount": 0, ++ "Driver": "overlay", ++ "MountLabel": "system_u:object_r:container_file_t:s0:c8,c574", ++ "ProcessLabel": "system_u:system_r:container_t:s0:c8,c574", ++ "AppArmorProfile": "", ++ "EffectiveCaps": [ ++ "CAP_CHOWN", ++ "CAP_DAC_OVERRIDE", ++ "CAP_FOWNER", ++ "CAP_FSETID", ++ "CAP_KILL", ++ "CAP_NET_BIND_SERVICE", ++ "CAP_SETFCAP", ++ "CAP_SETGID", ++ "CAP_SETPCAP", ++ "CAP_SETUID", ++ "CAP_SYS_CHROOT" ++ ], ++ "BoundingCaps": [ ++ "CAP_CHOWN", ++ "CAP_DAC_OVERRIDE", ++ "CAP_FOWNER", ++ "CAP_FSETID", ++ "CAP_KILL", ++ "CAP_NET_BIND_SERVICE", ++ "CAP_SETFCAP", ++ "CAP_SETGID", ++ "CAP_SETPCAP", ++ "CAP_SETUID", ++ "CAP_SYS_CHROOT" ++ ], ++ "ExecIDs": [], ++ "GraphDriver": { ++ "Name": "overlay", ++ "Data": { ++ "LowerDir": "/home/martin/.local/share/containers/storage/overlay/1da06ca5080c2ce2499e2f9802259209c7dd85c92d64852c3165425cdc18c443/diff", ++ "UpperDir": "/home/martin/.local/share/containers/storage/overlay/98294044df8fadc428b8a41befc0c83d574601b56076c62ce7fa93df6c48f8dc/diff", ++ "WorkDir": "/home/martin/.local/share/containers/storage/overlay/98294044df8fadc428b8a41befc0c83d574601b56076c62ce7fa93df6c48f8dc/work" ++ } ++ }, ++ "Mounts": [], ++ "Dependencies": [], ++ "NetworkSettings": { ++ "EndpointID": "", ++ "Gateway": "", ++ "IPAddress": "", ++ "IPPrefixLen": 0, ++ "IPv6Gateway": "", ++ "GlobalIPv6Address": "", ++ "GlobalIPv6PrefixLen": 0, ++ "MacAddress": "", ++ "Bridge": "", ++ "SandboxID": "", ++ "HairpinMode": false, ++ "LinkLocalIPv6Address": "", ++ "LinkLocalIPv6PrefixLen": 0, ++ "Ports": {}, ++ "SandboxKey": "" ++ }, ++ "Namespace": "", ++ "IsInfra": false, ++ "Config": { ++ "Hostname": "68485406c4bb", ++ "Domainname": "", ++ "User": "", ++ "AttachStdin": false, ++ "AttachStdout": false, ++ "AttachStderr": false, ++ "Tty": false, ++ "OpenStdin": false, ++ "StdinOnce": false, ++ "Env": [ ++ "FGC=f36", ++ "DISTTAG=f36container", ++ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", ++ "TERM=xterm", ++ "container=oci", ++ "HOME=/root", ++ "HOSTNAME=68485406c4bb" ++ ], ++ "Cmd": [ ++ "/bin/bash" ++ ], ++ "Image": "registry.fedoraproject.org/fedora:latest", ++ "Volumes": null, ++ "WorkingDir": "/", ++ "Entrypoint": "", ++ "OnBuild": null, ++ "Labels": { ++ "license": "MIT", ++ "name": "fedora", ++ "vendor": "Fedora Project", ++ "version": "36" ++ }, ++ "Annotations": { ++ "io.container.manager": "libpod", ++ "io.kubernetes.cri-o.Created": "2022-08-11T20:54:51.026287311+02:00", ++ "io.kubernetes.cri-o.TTY": "false", ++ "io.podman.annotations.autoremove": "FALSE", ++ "io.podman.annotations.init": "FALSE", ++ "io.podman.annotations.privileged": "FALSE", ++ "io.podman.annotations.publish-all": "FALSE", ++ "org.opencontainers.image.stopSignal": "15" ++ }, ++ "StopSignal": 15, ++ "CreateCommand": [ ++ "podman", ++ "run", ++ "--device", ++ "/dev/fb0", ++ "fedora" ++ ], ++ "Umask": "0022", ++ "Timeout": 0, ++ "StopTimeout": 10, ++ "Passwd": true ++ }, ++ "HostConfig": { ++ "Binds": [], ++ "CgroupManager": "systemd", ++ "CgroupMode": "private", ++ "ContainerIDFile": "", ++ "LogConfig": { ++ "Type": "journald", ++ "Config": null, ++ "Path": "", ++ "Tag": "", ++ "Size": "0B" ++ }, ++ "NetworkMode": "slirp4netns", ++ "PortBindings": {}, ++ "RestartPolicy": { ++ "Name": "", ++ "MaximumRetryCount": 0 ++ }, ++ "AutoRemove": false, ++ "VolumeDriver": "", ++ "VolumesFrom": null, ++ "CapAdd": [], ++ "CapDrop": [ ++ "CAP_AUDIT_WRITE", ++ "CAP_MKNOD", ++ "CAP_NET_RAW" ++ ], ++ "Dns": [], ++ "DnsOptions": [], ++ "DnsSearch": [], ++ "ExtraHosts": [], ++ "GroupAdd": [], ++ "IpcMode": "shareable", ++ "Cgroup": "", ++ "Cgroups": "default", ++ "Links": null, ++ "OomScoreAdj": 0, ++ "PidMode": "private", ++ "Privileged": false, ++ "PublishAllPorts": false, ++ "ReadonlyRootfs": false, ++ "SecurityOpt": [], ++ "Tmpfs": {}, ++ "UTSMode": "private", ++ "UsernsMode": "", ++ "ShmSize": 65536000, ++ "Runtime": "oci", ++ "ConsoleSize": [ ++ 0, ++ 0 ++ ], ++ "Isolation": "", ++ "CpuShares": 0, ++ "Memory": 0, ++ "NanoCpus": 0, ++ "CgroupParent": "user.slice", ++ "BlkioWeight": 0, ++ "BlkioWeightDevice": null, ++ "BlkioDeviceReadBps": null, ++ "BlkioDeviceWriteBps": null, ++ "BlkioDeviceReadIOps": null, ++ "BlkioDeviceWriteIOps": null, ++ "CpuPeriod": 0, ++ "CpuQuota": 0, ++ "CpuRealtimePeriod": 0, ++ "CpuRealtimeRuntime": 0, ++ "CpusetCpus": "", ++ "CpusetMems": "", ++ "Devices": [], ++ "DiskQuota": 0, ++ "KernelMemory": 0, ++ "MemoryReservation": 0, ++ "MemorySwap": 0, ++ "MemorySwappiness": 0, ++ "OomKillDisable": false, ++ "PidsLimit": 2048, ++ "Ulimits": [], ++ "CpuCount": 0, ++ "CpuPercent": 0, ++ "IOMaximumIOps": 0, ++ "IOMaximumBandwidth": 0, ++ "CgroupConf": null ++ } ++ } ++] +diff --git a/tests/test_main.py b/tests/test_main.py +index 6b30dc4..bc17cc2 100644 +--- a/tests/test_main.py ++++ b/tests/test_main.py +@@ -354,6 +354,21 @@ class TestBase(unittest.TestCase): + self.assert_templates(output, ["base_container"]) + self.assert_policy(test_file("test_devices.podman.cil")) + ++ def test_device_access_podman(self): ++ """podman run --device /dev/fb0 fedora""" ++ output = self.run_udica( ++ [ ++ "udica", ++ "-j", ++ "tests/test_devices.podman.json", ++ "--device-access", ++ "/dev/fd0", ++ "my_container", ++ ] ++ ) ++ self.assert_templates(output, ["base_container"]) ++ self.assert_policy(test_file("test_devices.podman.cil")) ++ + def run_udica(self, args): + with patch("sys.argv", args): + with patch("sys.stderr.write") as mock_err, patch( +-- +2.37.3 + diff --git a/0004-Rename-device-access-to-devices.patch b/0004-Rename-device-access-to-devices.patch new file mode 100644 index 0000000..e4d6e8a --- /dev/null +++ b/0004-Rename-device-access-to-devices.patch @@ -0,0 +1,101 @@ +From 34c0f137583001c5b7b0f8bf681b027aeff109cb Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Wed, 19 Oct 2022 16:34:46 +0200 +Subject: [PATCH 4/4] Rename --device-access to --devices + +This makes parameters more consistent. +Also, describe the new parameter in man page. + +Signed-off-by: Vit Mojzis +--- + tests/test_main.py | 4 ++-- + udica/__main__.py | 16 ++++++++-------- + udica/man/man8/udica.8 | 5 +++++ + udica/policy.py | 6 ++---- + 4 files changed, 17 insertions(+), 14 deletions(-) + +diff --git a/tests/test_main.py b/tests/test_main.py +index bc17cc2..f32588b 100644 +--- a/tests/test_main.py ++++ b/tests/test_main.py +@@ -361,8 +361,8 @@ class TestBase(unittest.TestCase): + "udica", + "-j", + "tests/test_devices.podman.json", +- "--device-access", +- "/dev/fd0", ++ "--devices", ++ "/dev/fb0", + "my_container", + ] + ) +diff --git a/udica/__main__.py b/udica/__main__.py +index 84e0ba4..103ddc2 100644 +--- a/udica/__main__.py ++++ b/udica/__main__.py +@@ -99,6 +99,14 @@ def get_args(): + dest="Caps", + default=None, + ) ++ parser.add_argument( ++ "--devices", ++ type=str, ++ help='List of devices the container should have access to, e.g "--devices /dev/dri/card0,/dev/dri/renderD128"', ++ dest="Devices", ++ required=False, ++ default=None, ++ ) + parser.add_argument( + "-d", + "--ansible", +@@ -127,14 +135,6 @@ def get_args(): + required=False, + default="-", + ) +- parser.add_argument( +- "--device-access", +- help='List of devices the container should have access to, e.g "--device-access /dev/dri/card0,/dev/dri/renderD128"', +- required=False, +- default=None, +- type=str, +- dest="DeviceAccess", +- ) + args = parser.parse_args() + return vars(args) + +diff --git a/udica/man/man8/udica.8 b/udica/man/man8/udica.8 +index 8c3a48e..c7158ff 100644 +--- a/udica/man/man8/udica.8 ++++ b/udica/man/man8/udica.8 +@@ -53,6 +53,11 @@ Load templates and module created by this tool + List of capabilities, for example: "\-c AUDIT\_WRITE,CHOWN,DAC\_OVERRIDE,FOWNER,FSETID,KILL" + (mandatory to use for Docker Engine, see the BUGS section) + ++.TP ++.I \-\-devices DEVS ++List of devices the container should have access to, e.g "\-\-devices /dev/dri/card0,/dev/dri/renderD128" ++(overrides devices specified in the conatiner JSON) ++ + .TP + .I \-a, \-\-append-rules FILE + Append more SELinux allow rules generated from SELinux denials in audit daemon. +diff --git a/udica/policy.py b/udica/policy.py +index 9b7a14f..9069c97 100644 +--- a/udica/policy.py ++++ b/udica/policy.py +@@ -173,10 +173,8 @@ def create_policy( + # devices + # Not applicable for CRI-O container engine + if inspect_format != "CRI-0": +- if not devices and opts["DeviceAccess"]: +- devices = [ +- {"PathOnHost": device} for device in opts["DeviceAccess"].split(",") +- ] ++ if opts["Devices"]: ++ devices = [{"PathOnHost": device} for device in opts["Devices"].split(",")] + write_policy_for_podman_devices(devices, policy) + + # mounts +-- +2.37.3 + diff --git a/udica.spec b/udica.spec index 53b2b86..5124cef 100644 --- a/udica.spec +++ b/udica.spec @@ -1,8 +1,12 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.7 -Release: 2%{?dist} +Release: 3%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz +Patch001: 0001-Add-device-access-option.patch +Patch002: 0002-Syntax-changes-after-running-black.patch +Patch003: 0003-Add-unit-test-for-device-access.patch +Patch004: 0004-Rename-device-access-to-devices.patch License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica @@ -58,6 +62,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Oct 21 2022 Vit Mojzis - 0.2.7-3 +- Add --devices option + * Sat Jul 23 2022 Fedora Release Engineering - 0.2.7-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From de462f29e02c99941236a1e97e1dc9f4a8c626af Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 18 Nov 2022 16:19:03 +0100 Subject: [PATCH 57/80] Migrate License tag to SPDX https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 --- udica.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 5124cef..3ad4bbc 100644 --- a/udica.spec +++ b/udica.spec @@ -7,7 +7,7 @@ Patch001: 0001-Add-device-access-option.patch Patch002: 0002-Syntax-changes-after-running-black.patch Patch003: 0003-Add-unit-test-for-device-access.patch Patch004: 0004-Rename-device-access-to-devices.patch -License: GPLv3+ +License: GPL-3.0-or-later BuildArch: noarch Url: https://github.com/containers/udica %if 0%{?fedora} || 0%{?rhel} > 7 From 9bc541dfbac86ddbd074cdcbb92f53635f4f9169 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 05:40:44 +0000 Subject: [PATCH 58/80] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 3ad4bbc..13512cc 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.7 -Release: 3%{?dist} +Release: 4%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz Patch001: 0001-Add-device-access-option.patch Patch002: 0002-Syntax-changes-after-running-black.patch @@ -62,6 +62,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 0.2.7-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Fri Oct 21 2022 Vit Mojzis - 0.2.7-3 - Add --devices option From 4a53696b71f0253557f0c32497c21b57ff8e52ce Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 11 Apr 2023 18:47:21 +0200 Subject: [PATCH 59/80] udica-0.2.7-5 - Show diff when checking formatting - Fix several lint findings - Fix generating policy for Crio mounts Fixes: https://github.com/containers/udica/issues/118 --- 0001-Add-device-access-option.patch | 2 +- 0002-Syntax-changes-after-running-black.patch | 2 +- 0003-Add-unit-test-for-device-access.patch | 2 +- 0004-Rename-device-access-to-devices.patch | 2 +- 0005-Show-diff-when-checking-formatting.patch | 29 +++++ 0006-Fix-several-lint-findings.patch | 38 ++++++ ...ix-generating-policy-for-Crio-mounts.patch | 116 ++++++++++++++++++ udica.spec | 19 ++- 8 files changed, 201 insertions(+), 9 deletions(-) create mode 100644 0005-Show-diff-when-checking-formatting.patch create mode 100644 0006-Fix-several-lint-findings.patch create mode 100644 0007-Fix-generating-policy-for-Crio-mounts.patch diff --git a/0001-Add-device-access-option.patch b/0001-Add-device-access-option.patch index 0770609..935f636 100644 --- a/0001-Add-device-access-option.patch +++ b/0001-Add-device-access-option.patch @@ -1,7 +1,7 @@ From a72b8fffc82657de85d20b3c9191d24a0b41e612 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Sk=C3=B8tt?= Date: Thu, 11 Aug 2022 14:20:14 +0200 -Subject: [PATCH 1/4] Add ---device--access option +Subject: [PATCH] Add ---device--access option MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0002-Syntax-changes-after-running-black.patch b/0002-Syntax-changes-after-running-black.patch index 9571da0..7d8e08d 100644 --- a/0002-Syntax-changes-after-running-black.patch +++ b/0002-Syntax-changes-after-running-black.patch @@ -1,7 +1,7 @@ From a2f0e4588e010e9df9da7bbd46fa4304335f9b25 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Sk=C3=B8tt?= Date: Thu, 11 Aug 2022 20:29:18 +0200 -Subject: [PATCH 2/4] Syntax changes after running black +Subject: [PATCH] Syntax changes after running black MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0003-Add-unit-test-for-device-access.patch b/0003-Add-unit-test-for-device-access.patch index 321a9b8..37e4a1c 100644 --- a/0003-Add-unit-test-for-device-access.patch +++ b/0003-Add-unit-test-for-device-access.patch @@ -1,7 +1,7 @@ From 0d3e3194e26a21c531d13bde5e45c0bce9717a99 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Sk=C3=B8tt?= Date: Thu, 11 Aug 2022 21:50:57 +0200 -Subject: [PATCH 3/4] Add unit test for --device-access +Subject: [PATCH] Add unit test for --device-access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0004-Rename-device-access-to-devices.patch b/0004-Rename-device-access-to-devices.patch index e4d6e8a..efd9a0f 100644 --- a/0004-Rename-device-access-to-devices.patch +++ b/0004-Rename-device-access-to-devices.patch @@ -1,7 +1,7 @@ From 34c0f137583001c5b7b0f8bf681b027aeff109cb Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 19 Oct 2022 16:34:46 +0200 -Subject: [PATCH 4/4] Rename --device-access to --devices +Subject: [PATCH] Rename --device-access to --devices This makes parameters more consistent. Also, describe the new parameter in man page. diff --git a/0005-Show-diff-when-checking-formatting.patch b/0005-Show-diff-when-checking-formatting.patch new file mode 100644 index 0000000..479a34d --- /dev/null +++ b/0005-Show-diff-when-checking-formatting.patch @@ -0,0 +1,29 @@ +From 07ff36fd09cb20196691a80b5dc1e544b64f12f3 Mon Sep 17 00:00:00 2001 +From: Chris Evich +Date: Wed, 29 Mar 2023 15:25:49 -0400 +Subject: [PATCH] Show diff when checking formatting + +Otherwise, all you get in CI is a failure notice w/o any indication as +to why. + +Signed-off-by: Chris Evich +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 2b2eda9..4d3b55e 100644 +--- a/Makefile ++++ b/Makefile +@@ -16,7 +16,7 @@ format: + + .PHONY: + format-check: +- black --check *.py udica/*.py tests/*.py ++ black --check --diff *.py udica/*.py tests/*.py + + .PHONY: test + test: lint format-check +-- +2.37.3 + diff --git a/0006-Fix-several-lint-findings.patch b/0006-Fix-several-lint-findings.patch new file mode 100644 index 0000000..44940d0 --- /dev/null +++ b/0006-Fix-several-lint-findings.patch @@ -0,0 +1,38 @@ +From 5d6feb3a6c900d119732a20145352b2459fafcde Mon Sep 17 00:00:00 2001 +From: Chris Evich +Date: Wed, 29 Mar 2023 15:34:13 -0400 +Subject: [PATCH] Fix several lint findings + +Signed-off-by: Chris Evich +--- + udica/__main__.py | 1 - + udica/policy.py | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/udica/__main__.py b/udica/__main__.py +index 103ddc2..43d2e43 100644 +--- a/udica/__main__.py ++++ b/udica/__main__.py +@@ -140,7 +140,6 @@ def get_args(): + + + def main(): +- + opts = get_args() + + if opts["ContainerID"]: +diff --git a/udica/policy.py b/udica/policy.py +index 9069c97..e32b077 100644 +--- a/udica/policy.py ++++ b/udica/policy.py +@@ -88,7 +88,6 @@ def list_contexts(directory): + + + def list_ports(port_number, port_proto): +- + handle = semanage.semanage_handle_create() + semanage.semanage_connect(handle) + +-- +2.37.3 + diff --git a/0007-Fix-generating-policy-for-Crio-mounts.patch b/0007-Fix-generating-policy-for-Crio-mounts.patch new file mode 100644 index 0000000..1e3a275 --- /dev/null +++ b/0007-Fix-generating-policy-for-Crio-mounts.patch @@ -0,0 +1,116 @@ +From 6a7382bead93a1777370e4bf37f545a22f3bfb4c Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Tue, 11 Apr 2023 18:15:13 +0200 +Subject: [PATCH] Fix generating policy for Crio mounts + +Fix issue introduced by +Commit 7c7b9ad505ab6b7cd809d30f1699d4bb7323ce0a +"Avoid duplicate rules for accessing mounts and devices" +where policy rules for "read-only mounts" are not generated properly. + +Adjust Crio basic test to incorporate a read only mount that is not +covered by a special case ("/home" is handled by "home_container" and +anything under "/var/lib/kubelet" is ignored). + +Thanks https://github.com/arcardon (jamjcardona@sbcglobal.net) for +spotting this in the code. + +Signed-off-by: Vit Mojzis +--- + tests/selinux.py | 4 ++++ + tests/test_basic.cri.cil | 6 +++++- + tests/test_basic.cri.json | 4 ++-- + tests/test_main.py | 4 ++-- + udica/policy.py | 2 +- + 5 files changed, 14 insertions(+), 6 deletions(-) + +diff --git a/tests/selinux.py b/tests/selinux.py +index f56d132..3f720a5 100644 +--- a/tests/selinux.py ++++ b/tests/selinux.py +@@ -25,6 +25,8 @@ def selabel_lookup(selabel, directory, rc): + return (0, None) + elif directory == "/dev/fb0": + return (0, "system_u:object_r:framebuf_device_t:s0") ++ elif directory == "/etc/hosts": ++ return (0, "system_u:object_r:net_conf_t:s0") + else: + return (0, "system_u:object_r:var_spool_t:s0") + +@@ -32,5 +34,7 @@ def selabel_lookup(selabel, directory, rc): + def getfilecon(directory): + if directory == "/tmp/test": + return (0, "system_u:object_r:user_tmp_t:s0") ++ elif directory == "/etc/hosts": ++ return (0, "system_u:object_r:net_conf_t:s0") + else: + return (0, "system_u:object_r:var_spool_t:s0") +diff --git a/tests/test_basic.cri.cil b/tests/test_basic.cri.cil +index 47a3705..52d5771 100644 +--- a/tests/test_basic.cri.cil ++++ b/tests/test_basic.cri.cil +@@ -250,4 +250,8 @@ + (allow process zoneminder_spool_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write ))) + (allow process zoneminder_spool_t ( fifo_file ( getattr read write append ioctl lock open ))) + (allow process zoneminder_spool_t ( sock_file ( append getattr open read write ))) +-) +\ No newline at end of file ++ (allow process net_conf_t ( dir ( getattr ioctl lock open read search ))) ++ (allow process net_conf_t ( file ( getattr ioctl lock open read ))) ++ (allow process net_conf_t ( fifo_file ( getattr open read lock ioctl ))) ++ (allow process net_conf_t ( sock_file ( getattr open read ))) ++) +diff --git a/tests/test_basic.cri.json b/tests/test_basic.cri.json +index e16f9aa..c21705d 100644 +--- a/tests/test_basic.cri.json ++++ b/tests/test_basic.cri.json +@@ -46,9 +46,9 @@ + }, + { + "containerPath": "/etc/hosts", +- "hostPath": "/var/lib/kubelet/pods/59ecb6eb-de09-11e9-8ebe-02e4204e049a/etc-hosts", ++ "hostPath": "/etc/hosts", + "propagation": "PROPAGATION_PRIVATE", +- "readonly": false, ++ "readonly": true, + "selinuxRelabel": false + }, + { +diff --git a/tests/test_main.py b/tests/test_main.py +index f32588b..fb6a9ab 100644 +--- a/tests/test_main.py ++++ b/tests/test_main.py +@@ -119,7 +119,7 @@ class TestBase(unittest.TestCase): + self.assert_policy(test_file("test_basic.docker.cil")) + + def test_basic_cri(self): +- """Start CRI-O mounting /var/spool with read/write perms and /home with readonly perms""" ++ """Start CRI-O mounting /var/spool with read/write perms and /home and /etc/hosts with readonly perms""" + output = self.run_udica( + [ + "udica", +@@ -135,7 +135,7 @@ class TestBase(unittest.TestCase): + self.assert_policy(test_file("test_basic.cri.cil")) + + def test_basic_specified_engine_cri(self): +- """Start CRI-O mounting /var/spool with read/write perms and /home with readonly perms""" ++ """Start CRI-O mounting /var/spool with read/write perms and /home and /etc/hosts with readonly perms""" + output = self.run_udica( + [ + "udica", +diff --git a/udica/policy.py b/udica/policy.py +index e32b077..9d1eae0 100644 +--- a/udica/policy.py ++++ b/udica/policy.py +@@ -284,7 +284,7 @@ def write_policy_for_crio_mounts(mounts, policy): + + " ))) \n" + ) + +- for contexts in sorted(set(contexts_readonly)): ++ for context in sorted(set(contexts_readonly)): + policy.write( + " (allow process " + + context +-- +2.38.1 + diff --git a/udica.spec b/udica.spec index 13512cc..2fc34e6 100644 --- a/udica.spec +++ b/udica.spec @@ -1,12 +1,16 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.7 -Release: 4%{?dist} +Release: 5%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz -Patch001: 0001-Add-device-access-option.patch -Patch002: 0002-Syntax-changes-after-running-black.patch -Patch003: 0003-Add-unit-test-for-device-access.patch -Patch004: 0004-Rename-device-access-to-devices.patch +#git format-patch -N 4a64ff7c1b8116a1894e72eee2a19706e970001f -- . ':!.cirrus.yml' ':!.github' +Patch0001: 0001-Add-device-access-option.patch +Patch0002: 0002-Syntax-changes-after-running-black.patch +Patch0003: 0003-Add-unit-test-for-device-access.patch +Patch0004: 0004-Rename-device-access-to-devices.patch +Patch0005: 0005-Show-diff-when-checking-formatting.patch +Patch0006: 0006-Fix-several-lint-findings.patch +Patch0007: 0007-Fix-generating-policy-for-Crio-mounts.patch License: GPL-3.0-or-later BuildArch: noarch Url: https://github.com/containers/udica @@ -62,6 +66,11 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Tue Apr 11 2023 Vit Mojzis - 0.2.7-5 +- Show diff when checking formatting +- Fix several lint findings +- Fix generating policy for Crio mounts + * Sat Jan 21 2023 Fedora Release Engineering - 0.2.7-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From e5322cdeacd4c5e915aa831109bc4b15fa5ba966 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Tue, 13 Jun 2023 21:00:03 +0200 Subject: [PATCH 60/80] Rebuilt for Python 3.12 --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 2fc34e6..591c43b 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.7 -Release: 5%{?dist} +Release: 6%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N 4a64ff7c1b8116a1894e72eee2a19706e970001f -- . ':!.cirrus.yml' ':!.github' Patch0001: 0001-Add-device-access-option.patch @@ -66,6 +66,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Tue Jun 13 2023 Python Maint - 0.2.7-6 +- Rebuilt for Python 3.12 + * Tue Apr 11 2023 Vit Mojzis - 0.2.7-5 - Show diff when checking formatting - Fix several lint findings From b6b508898062324d967b1d6ffa8241b34842b802 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 16:59:26 +0000 Subject: [PATCH 61/80] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 591c43b..557bf3a 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.7 -Release: 6%{?dist} +Release: 7%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N 4a64ff7c1b8116a1894e72eee2a19706e970001f -- . ':!.cirrus.yml' ':!.github' Patch0001: 0001-Add-device-access-option.patch @@ -66,6 +66,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 0.2.7-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Tue Jun 13 2023 Python Maint - 0.2.7-6 - Rebuilt for Python 3.12 From 5e0609b1fe8fd5efbfbcbc7440d953d47998b38b Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 29 Nov 2023 12:36:32 +0100 Subject: [PATCH 62/80] udica-0.2.8 New release https://github.com/containers/udica/releases/tag/v0.2.8 --- .gitignore | 1 + 0001-Add-device-access-option.patch | 49 --- 0002-Syntax-changes-after-running-black.patch | 47 --- 0003-Add-unit-test-for-device-access.patch | 294 ------------------ 0004-Rename-device-access-to-devices.patch | 101 ------ 0005-Show-diff-when-checking-formatting.patch | 29 -- 0006-Fix-several-lint-findings.patch | 38 --- ...ix-generating-policy-for-Crio-mounts.patch | 116 ------- sources | 2 +- udica.spec | 14 +- 10 files changed, 7 insertions(+), 684 deletions(-) delete mode 100644 0001-Add-device-access-option.patch delete mode 100644 0002-Syntax-changes-after-running-black.patch delete mode 100644 0003-Add-unit-test-for-device-access.patch delete mode 100644 0004-Rename-device-access-to-devices.patch delete mode 100644 0005-Show-diff-when-checking-formatting.patch delete mode 100644 0006-Fix-several-lint-findings.patch delete mode 100644 0007-Fix-generating-policy-for-Crio-mounts.patch diff --git a/.gitignore b/.gitignore index 8b13f70..d3d498c 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,4 @@ /v0.2.5.tar.gz /v0.2.6.tar.gz /v0.2.7.tar.gz +/v0.2.8.tar.gz diff --git a/0001-Add-device-access-option.patch b/0001-Add-device-access-option.patch deleted file mode 100644 index 935f636..0000000 --- a/0001-Add-device-access-option.patch +++ /dev/null @@ -1,49 +0,0 @@ -From a72b8fffc82657de85d20b3c9191d24a0b41e612 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Martin=20Sk=C3=B8tt?= -Date: Thu, 11 Aug 2022 14:20:14 +0200 -Subject: [PATCH] Add ---device--access option -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Signed-off-by: Martin Skøtt ---- - udica/__main__.py | 8 ++++++++ - udica/policy.py | 2 ++ - 2 files changed, 10 insertions(+) - -diff --git a/udica/__main__.py b/udica/__main__.py -index d72a4b4..9cb276d 100644 ---- a/udica/__main__.py -+++ b/udica/__main__.py -@@ -127,6 +127,14 @@ def get_args(): - required=False, - default="-", - ) -+ parser.add_argument( -+ "--device-access", -+ help='List of devices the container should have access to, e.g "--device-access /dev/dri/card0,/dev/dri/renderD128"', -+ required=False, -+ default=None, -+ type=str, -+ dest='DeviceAccess' -+ ) - args = parser.parse_args() - return vars(args) - -diff --git a/udica/policy.py b/udica/policy.py -index ec6ce20..0f1145a 100644 ---- a/udica/policy.py -+++ b/udica/policy.py -@@ -173,6 +173,8 @@ def create_policy( - # devices - # Not applicable for CRI-O container engine - if inspect_format != "CRI-0": -+ if (not devices and opts["DeviceAccess"]): -+ devices = [{"PathOnHost": device} for device in opts["DeviceAccess"].split(',')] - write_policy_for_podman_devices(devices, policy) - - # mounts --- -2.37.3 - diff --git a/0002-Syntax-changes-after-running-black.patch b/0002-Syntax-changes-after-running-black.patch deleted file mode 100644 index 7d8e08d..0000000 --- a/0002-Syntax-changes-after-running-black.patch +++ /dev/null @@ -1,47 +0,0 @@ -From a2f0e4588e010e9df9da7bbd46fa4304335f9b25 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Martin=20Sk=C3=B8tt?= -Date: Thu, 11 Aug 2022 20:29:18 +0200 -Subject: [PATCH] Syntax changes after running black -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Signed-off-by: Martin Skøtt ---- - udica/__main__.py | 2 +- - udica/policy.py | 6 ++++-- - 2 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/udica/__main__.py b/udica/__main__.py -index 9cb276d..84e0ba4 100644 ---- a/udica/__main__.py -+++ b/udica/__main__.py -@@ -133,7 +133,7 @@ def get_args(): - required=False, - default=None, - type=str, -- dest='DeviceAccess' -+ dest="DeviceAccess", - ) - args = parser.parse_args() - return vars(args) -diff --git a/udica/policy.py b/udica/policy.py -index 0f1145a..9b7a14f 100644 ---- a/udica/policy.py -+++ b/udica/policy.py -@@ -173,8 +173,10 @@ def create_policy( - # devices - # Not applicable for CRI-O container engine - if inspect_format != "CRI-0": -- if (not devices and opts["DeviceAccess"]): -- devices = [{"PathOnHost": device} for device in opts["DeviceAccess"].split(',')] -+ if not devices and opts["DeviceAccess"]: -+ devices = [ -+ {"PathOnHost": device} for device in opts["DeviceAccess"].split(",") -+ ] - write_policy_for_podman_devices(devices, policy) - - # mounts --- -2.37.3 - diff --git a/0003-Add-unit-test-for-device-access.patch b/0003-Add-unit-test-for-device-access.patch deleted file mode 100644 index 37e4a1c..0000000 --- a/0003-Add-unit-test-for-device-access.patch +++ /dev/null @@ -1,294 +0,0 @@ -From 0d3e3194e26a21c531d13bde5e45c0bce9717a99 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Martin=20Sk=C3=B8tt?= -Date: Thu, 11 Aug 2022 21:50:57 +0200 -Subject: [PATCH] Add unit test for --device-access -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Signed-off-by: Martin Skøtt ---- - tests/test_device_access.podman.json | 244 +++++++++++++++++++++++++++ - tests/test_main.py | 15 ++ - 2 files changed, 259 insertions(+) - create mode 100644 tests/test_device_access.podman.json - -diff --git a/tests/test_device_access.podman.json b/tests/test_device_access.podman.json -new file mode 100644 -index 0000000..9a806a2 ---- /dev/null -+++ b/tests/test_device_access.podman.json -@@ -0,0 +1,244 @@ -+[ -+ { -+ "Id": "68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744", -+ "Created": "2022-08-11T20:54:51.026287311+02:00", -+ "Path": "/bin/bash", -+ "Args": [ -+ "/bin/bash" -+ ], -+ "State": { -+ "OciVersion": "1.0.2-dev", -+ "Status": "exited", -+ "Running": false, -+ "Paused": false, -+ "Restarting": false, -+ "OOMKilled": false, -+ "Dead": false, -+ "Pid": 0, -+ "ExitCode": 0, -+ "Error": "", -+ "StartedAt": "2022-08-11T20:54:51.116938836+02:00", -+ "FinishedAt": "2022-08-11T20:54:51.1327839+02:00", -+ "Health": { -+ "Status": "", -+ "FailingStreak": 0, -+ "Log": null -+ }, -+ "CheckpointedAt": "0001-01-01T00:00:00Z", -+ "RestoredAt": "0001-01-01T00:00:00Z" -+ }, -+ "Image": "2ecb6df959942dd2fdeb65606ca2e42a54f8c06af10eeb594fdfc3e2656c53d1", -+ "ImageName": "registry.fedoraproject.org/fedora:latest", -+ "Rootfs": "", -+ "Pod": "", -+ "ResolvConfPath": "/run/user/1000/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/resolv.conf", -+ "HostnamePath": "/run/user/1000/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/hostname", -+ "HostsPath": "/run/user/1000/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/hosts", -+ "StaticDir": "/home/martin/.local/share/containers/storage/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata", -+ "OCIConfigPath": "/home/martin/.local/share/containers/storage/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/config.json", -+ "OCIRuntime": "crun", -+ "ConmonPidFile": "/run/user/1000/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/conmon.pid", -+ "PidFile": "/run/user/1000/overlay-containers/68485406c4bbfd2b379beac7d80834a4ca94d7e74ada5019c7499afed62e1744/userdata/pidfile", -+ "Name": "charming_khorana", -+ "RestartCount": 0, -+ "Driver": "overlay", -+ "MountLabel": "system_u:object_r:container_file_t:s0:c8,c574", -+ "ProcessLabel": "system_u:system_r:container_t:s0:c8,c574", -+ "AppArmorProfile": "", -+ "EffectiveCaps": [ -+ "CAP_CHOWN", -+ "CAP_DAC_OVERRIDE", -+ "CAP_FOWNER", -+ "CAP_FSETID", -+ "CAP_KILL", -+ "CAP_NET_BIND_SERVICE", -+ "CAP_SETFCAP", -+ "CAP_SETGID", -+ "CAP_SETPCAP", -+ "CAP_SETUID", -+ "CAP_SYS_CHROOT" -+ ], -+ "BoundingCaps": [ -+ "CAP_CHOWN", -+ "CAP_DAC_OVERRIDE", -+ "CAP_FOWNER", -+ "CAP_FSETID", -+ "CAP_KILL", -+ "CAP_NET_BIND_SERVICE", -+ "CAP_SETFCAP", -+ "CAP_SETGID", -+ "CAP_SETPCAP", -+ "CAP_SETUID", -+ "CAP_SYS_CHROOT" -+ ], -+ "ExecIDs": [], -+ "GraphDriver": { -+ "Name": "overlay", -+ "Data": { -+ "LowerDir": "/home/martin/.local/share/containers/storage/overlay/1da06ca5080c2ce2499e2f9802259209c7dd85c92d64852c3165425cdc18c443/diff", -+ "UpperDir": "/home/martin/.local/share/containers/storage/overlay/98294044df8fadc428b8a41befc0c83d574601b56076c62ce7fa93df6c48f8dc/diff", -+ "WorkDir": "/home/martin/.local/share/containers/storage/overlay/98294044df8fadc428b8a41befc0c83d574601b56076c62ce7fa93df6c48f8dc/work" -+ } -+ }, -+ "Mounts": [], -+ "Dependencies": [], -+ "NetworkSettings": { -+ "EndpointID": "", -+ "Gateway": "", -+ "IPAddress": "", -+ "IPPrefixLen": 0, -+ "IPv6Gateway": "", -+ "GlobalIPv6Address": "", -+ "GlobalIPv6PrefixLen": 0, -+ "MacAddress": "", -+ "Bridge": "", -+ "SandboxID": "", -+ "HairpinMode": false, -+ "LinkLocalIPv6Address": "", -+ "LinkLocalIPv6PrefixLen": 0, -+ "Ports": {}, -+ "SandboxKey": "" -+ }, -+ "Namespace": "", -+ "IsInfra": false, -+ "Config": { -+ "Hostname": "68485406c4bb", -+ "Domainname": "", -+ "User": "", -+ "AttachStdin": false, -+ "AttachStdout": false, -+ "AttachStderr": false, -+ "Tty": false, -+ "OpenStdin": false, -+ "StdinOnce": false, -+ "Env": [ -+ "FGC=f36", -+ "DISTTAG=f36container", -+ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", -+ "TERM=xterm", -+ "container=oci", -+ "HOME=/root", -+ "HOSTNAME=68485406c4bb" -+ ], -+ "Cmd": [ -+ "/bin/bash" -+ ], -+ "Image": "registry.fedoraproject.org/fedora:latest", -+ "Volumes": null, -+ "WorkingDir": "/", -+ "Entrypoint": "", -+ "OnBuild": null, -+ "Labels": { -+ "license": "MIT", -+ "name": "fedora", -+ "vendor": "Fedora Project", -+ "version": "36" -+ }, -+ "Annotations": { -+ "io.container.manager": "libpod", -+ "io.kubernetes.cri-o.Created": "2022-08-11T20:54:51.026287311+02:00", -+ "io.kubernetes.cri-o.TTY": "false", -+ "io.podman.annotations.autoremove": "FALSE", -+ "io.podman.annotations.init": "FALSE", -+ "io.podman.annotations.privileged": "FALSE", -+ "io.podman.annotations.publish-all": "FALSE", -+ "org.opencontainers.image.stopSignal": "15" -+ }, -+ "StopSignal": 15, -+ "CreateCommand": [ -+ "podman", -+ "run", -+ "--device", -+ "/dev/fb0", -+ "fedora" -+ ], -+ "Umask": "0022", -+ "Timeout": 0, -+ "StopTimeout": 10, -+ "Passwd": true -+ }, -+ "HostConfig": { -+ "Binds": [], -+ "CgroupManager": "systemd", -+ "CgroupMode": "private", -+ "ContainerIDFile": "", -+ "LogConfig": { -+ "Type": "journald", -+ "Config": null, -+ "Path": "", -+ "Tag": "", -+ "Size": "0B" -+ }, -+ "NetworkMode": "slirp4netns", -+ "PortBindings": {}, -+ "RestartPolicy": { -+ "Name": "", -+ "MaximumRetryCount": 0 -+ }, -+ "AutoRemove": false, -+ "VolumeDriver": "", -+ "VolumesFrom": null, -+ "CapAdd": [], -+ "CapDrop": [ -+ "CAP_AUDIT_WRITE", -+ "CAP_MKNOD", -+ "CAP_NET_RAW" -+ ], -+ "Dns": [], -+ "DnsOptions": [], -+ "DnsSearch": [], -+ "ExtraHosts": [], -+ "GroupAdd": [], -+ "IpcMode": "shareable", -+ "Cgroup": "", -+ "Cgroups": "default", -+ "Links": null, -+ "OomScoreAdj": 0, -+ "PidMode": "private", -+ "Privileged": false, -+ "PublishAllPorts": false, -+ "ReadonlyRootfs": false, -+ "SecurityOpt": [], -+ "Tmpfs": {}, -+ "UTSMode": "private", -+ "UsernsMode": "", -+ "ShmSize": 65536000, -+ "Runtime": "oci", -+ "ConsoleSize": [ -+ 0, -+ 0 -+ ], -+ "Isolation": "", -+ "CpuShares": 0, -+ "Memory": 0, -+ "NanoCpus": 0, -+ "CgroupParent": "user.slice", -+ "BlkioWeight": 0, -+ "BlkioWeightDevice": null, -+ "BlkioDeviceReadBps": null, -+ "BlkioDeviceWriteBps": null, -+ "BlkioDeviceReadIOps": null, -+ "BlkioDeviceWriteIOps": null, -+ "CpuPeriod": 0, -+ "CpuQuota": 0, -+ "CpuRealtimePeriod": 0, -+ "CpuRealtimeRuntime": 0, -+ "CpusetCpus": "", -+ "CpusetMems": "", -+ "Devices": [], -+ "DiskQuota": 0, -+ "KernelMemory": 0, -+ "MemoryReservation": 0, -+ "MemorySwap": 0, -+ "MemorySwappiness": 0, -+ "OomKillDisable": false, -+ "PidsLimit": 2048, -+ "Ulimits": [], -+ "CpuCount": 0, -+ "CpuPercent": 0, -+ "IOMaximumIOps": 0, -+ "IOMaximumBandwidth": 0, -+ "CgroupConf": null -+ } -+ } -+] -diff --git a/tests/test_main.py b/tests/test_main.py -index 6b30dc4..bc17cc2 100644 ---- a/tests/test_main.py -+++ b/tests/test_main.py -@@ -354,6 +354,21 @@ class TestBase(unittest.TestCase): - self.assert_templates(output, ["base_container"]) - self.assert_policy(test_file("test_devices.podman.cil")) - -+ def test_device_access_podman(self): -+ """podman run --device /dev/fb0 fedora""" -+ output = self.run_udica( -+ [ -+ "udica", -+ "-j", -+ "tests/test_devices.podman.json", -+ "--device-access", -+ "/dev/fd0", -+ "my_container", -+ ] -+ ) -+ self.assert_templates(output, ["base_container"]) -+ self.assert_policy(test_file("test_devices.podman.cil")) -+ - def run_udica(self, args): - with patch("sys.argv", args): - with patch("sys.stderr.write") as mock_err, patch( --- -2.37.3 - diff --git a/0004-Rename-device-access-to-devices.patch b/0004-Rename-device-access-to-devices.patch deleted file mode 100644 index efd9a0f..0000000 --- a/0004-Rename-device-access-to-devices.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 34c0f137583001c5b7b0f8bf681b027aeff109cb Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Wed, 19 Oct 2022 16:34:46 +0200 -Subject: [PATCH] Rename --device-access to --devices - -This makes parameters more consistent. -Also, describe the new parameter in man page. - -Signed-off-by: Vit Mojzis ---- - tests/test_main.py | 4 ++-- - udica/__main__.py | 16 ++++++++-------- - udica/man/man8/udica.8 | 5 +++++ - udica/policy.py | 6 ++---- - 4 files changed, 17 insertions(+), 14 deletions(-) - -diff --git a/tests/test_main.py b/tests/test_main.py -index bc17cc2..f32588b 100644 ---- a/tests/test_main.py -+++ b/tests/test_main.py -@@ -361,8 +361,8 @@ class TestBase(unittest.TestCase): - "udica", - "-j", - "tests/test_devices.podman.json", -- "--device-access", -- "/dev/fd0", -+ "--devices", -+ "/dev/fb0", - "my_container", - ] - ) -diff --git a/udica/__main__.py b/udica/__main__.py -index 84e0ba4..103ddc2 100644 ---- a/udica/__main__.py -+++ b/udica/__main__.py -@@ -99,6 +99,14 @@ def get_args(): - dest="Caps", - default=None, - ) -+ parser.add_argument( -+ "--devices", -+ type=str, -+ help='List of devices the container should have access to, e.g "--devices /dev/dri/card0,/dev/dri/renderD128"', -+ dest="Devices", -+ required=False, -+ default=None, -+ ) - parser.add_argument( - "-d", - "--ansible", -@@ -127,14 +135,6 @@ def get_args(): - required=False, - default="-", - ) -- parser.add_argument( -- "--device-access", -- help='List of devices the container should have access to, e.g "--device-access /dev/dri/card0,/dev/dri/renderD128"', -- required=False, -- default=None, -- type=str, -- dest="DeviceAccess", -- ) - args = parser.parse_args() - return vars(args) - -diff --git a/udica/man/man8/udica.8 b/udica/man/man8/udica.8 -index 8c3a48e..c7158ff 100644 ---- a/udica/man/man8/udica.8 -+++ b/udica/man/man8/udica.8 -@@ -53,6 +53,11 @@ Load templates and module created by this tool - List of capabilities, for example: "\-c AUDIT\_WRITE,CHOWN,DAC\_OVERRIDE,FOWNER,FSETID,KILL" - (mandatory to use for Docker Engine, see the BUGS section) - -+.TP -+.I \-\-devices DEVS -+List of devices the container should have access to, e.g "\-\-devices /dev/dri/card0,/dev/dri/renderD128" -+(overrides devices specified in the conatiner JSON) -+ - .TP - .I \-a, \-\-append-rules FILE - Append more SELinux allow rules generated from SELinux denials in audit daemon. -diff --git a/udica/policy.py b/udica/policy.py -index 9b7a14f..9069c97 100644 ---- a/udica/policy.py -+++ b/udica/policy.py -@@ -173,10 +173,8 @@ def create_policy( - # devices - # Not applicable for CRI-O container engine - if inspect_format != "CRI-0": -- if not devices and opts["DeviceAccess"]: -- devices = [ -- {"PathOnHost": device} for device in opts["DeviceAccess"].split(",") -- ] -+ if opts["Devices"]: -+ devices = [{"PathOnHost": device} for device in opts["Devices"].split(",")] - write_policy_for_podman_devices(devices, policy) - - # mounts --- -2.37.3 - diff --git a/0005-Show-diff-when-checking-formatting.patch b/0005-Show-diff-when-checking-formatting.patch deleted file mode 100644 index 479a34d..0000000 --- a/0005-Show-diff-when-checking-formatting.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 07ff36fd09cb20196691a80b5dc1e544b64f12f3 Mon Sep 17 00:00:00 2001 -From: Chris Evich -Date: Wed, 29 Mar 2023 15:25:49 -0400 -Subject: [PATCH] Show diff when checking formatting - -Otherwise, all you get in CI is a failure notice w/o any indication as -to why. - -Signed-off-by: Chris Evich ---- - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index 2b2eda9..4d3b55e 100644 ---- a/Makefile -+++ b/Makefile -@@ -16,7 +16,7 @@ format: - - .PHONY: - format-check: -- black --check *.py udica/*.py tests/*.py -+ black --check --diff *.py udica/*.py tests/*.py - - .PHONY: test - test: lint format-check --- -2.37.3 - diff --git a/0006-Fix-several-lint-findings.patch b/0006-Fix-several-lint-findings.patch deleted file mode 100644 index 44940d0..0000000 --- a/0006-Fix-several-lint-findings.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 5d6feb3a6c900d119732a20145352b2459fafcde Mon Sep 17 00:00:00 2001 -From: Chris Evich -Date: Wed, 29 Mar 2023 15:34:13 -0400 -Subject: [PATCH] Fix several lint findings - -Signed-off-by: Chris Evich ---- - udica/__main__.py | 1 - - udica/policy.py | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/udica/__main__.py b/udica/__main__.py -index 103ddc2..43d2e43 100644 ---- a/udica/__main__.py -+++ b/udica/__main__.py -@@ -140,7 +140,6 @@ def get_args(): - - - def main(): -- - opts = get_args() - - if opts["ContainerID"]: -diff --git a/udica/policy.py b/udica/policy.py -index 9069c97..e32b077 100644 ---- a/udica/policy.py -+++ b/udica/policy.py -@@ -88,7 +88,6 @@ def list_contexts(directory): - - - def list_ports(port_number, port_proto): -- - handle = semanage.semanage_handle_create() - semanage.semanage_connect(handle) - --- -2.37.3 - diff --git a/0007-Fix-generating-policy-for-Crio-mounts.patch b/0007-Fix-generating-policy-for-Crio-mounts.patch deleted file mode 100644 index 1e3a275..0000000 --- a/0007-Fix-generating-policy-for-Crio-mounts.patch +++ /dev/null @@ -1,116 +0,0 @@ -From 6a7382bead93a1777370e4bf37f545a22f3bfb4c Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Tue, 11 Apr 2023 18:15:13 +0200 -Subject: [PATCH] Fix generating policy for Crio mounts - -Fix issue introduced by -Commit 7c7b9ad505ab6b7cd809d30f1699d4bb7323ce0a -"Avoid duplicate rules for accessing mounts and devices" -where policy rules for "read-only mounts" are not generated properly. - -Adjust Crio basic test to incorporate a read only mount that is not -covered by a special case ("/home" is handled by "home_container" and -anything under "/var/lib/kubelet" is ignored). - -Thanks https://github.com/arcardon (jamjcardona@sbcglobal.net) for -spotting this in the code. - -Signed-off-by: Vit Mojzis ---- - tests/selinux.py | 4 ++++ - tests/test_basic.cri.cil | 6 +++++- - tests/test_basic.cri.json | 4 ++-- - tests/test_main.py | 4 ++-- - udica/policy.py | 2 +- - 5 files changed, 14 insertions(+), 6 deletions(-) - -diff --git a/tests/selinux.py b/tests/selinux.py -index f56d132..3f720a5 100644 ---- a/tests/selinux.py -+++ b/tests/selinux.py -@@ -25,6 +25,8 @@ def selabel_lookup(selabel, directory, rc): - return (0, None) - elif directory == "/dev/fb0": - return (0, "system_u:object_r:framebuf_device_t:s0") -+ elif directory == "/etc/hosts": -+ return (0, "system_u:object_r:net_conf_t:s0") - else: - return (0, "system_u:object_r:var_spool_t:s0") - -@@ -32,5 +34,7 @@ def selabel_lookup(selabel, directory, rc): - def getfilecon(directory): - if directory == "/tmp/test": - return (0, "system_u:object_r:user_tmp_t:s0") -+ elif directory == "/etc/hosts": -+ return (0, "system_u:object_r:net_conf_t:s0") - else: - return (0, "system_u:object_r:var_spool_t:s0") -diff --git a/tests/test_basic.cri.cil b/tests/test_basic.cri.cil -index 47a3705..52d5771 100644 ---- a/tests/test_basic.cri.cil -+++ b/tests/test_basic.cri.cil -@@ -250,4 +250,8 @@ - (allow process zoneminder_spool_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write ))) - (allow process zoneminder_spool_t ( fifo_file ( getattr read write append ioctl lock open ))) - (allow process zoneminder_spool_t ( sock_file ( append getattr open read write ))) --) -\ No newline at end of file -+ (allow process net_conf_t ( dir ( getattr ioctl lock open read search ))) -+ (allow process net_conf_t ( file ( getattr ioctl lock open read ))) -+ (allow process net_conf_t ( fifo_file ( getattr open read lock ioctl ))) -+ (allow process net_conf_t ( sock_file ( getattr open read ))) -+) -diff --git a/tests/test_basic.cri.json b/tests/test_basic.cri.json -index e16f9aa..c21705d 100644 ---- a/tests/test_basic.cri.json -+++ b/tests/test_basic.cri.json -@@ -46,9 +46,9 @@ - }, - { - "containerPath": "/etc/hosts", -- "hostPath": "/var/lib/kubelet/pods/59ecb6eb-de09-11e9-8ebe-02e4204e049a/etc-hosts", -+ "hostPath": "/etc/hosts", - "propagation": "PROPAGATION_PRIVATE", -- "readonly": false, -+ "readonly": true, - "selinuxRelabel": false - }, - { -diff --git a/tests/test_main.py b/tests/test_main.py -index f32588b..fb6a9ab 100644 ---- a/tests/test_main.py -+++ b/tests/test_main.py -@@ -119,7 +119,7 @@ class TestBase(unittest.TestCase): - self.assert_policy(test_file("test_basic.docker.cil")) - - def test_basic_cri(self): -- """Start CRI-O mounting /var/spool with read/write perms and /home with readonly perms""" -+ """Start CRI-O mounting /var/spool with read/write perms and /home and /etc/hosts with readonly perms""" - output = self.run_udica( - [ - "udica", -@@ -135,7 +135,7 @@ class TestBase(unittest.TestCase): - self.assert_policy(test_file("test_basic.cri.cil")) - - def test_basic_specified_engine_cri(self): -- """Start CRI-O mounting /var/spool with read/write perms and /home with readonly perms""" -+ """Start CRI-O mounting /var/spool with read/write perms and /home and /etc/hosts with readonly perms""" - output = self.run_udica( - [ - "udica", -diff --git a/udica/policy.py b/udica/policy.py -index e32b077..9d1eae0 100644 ---- a/udica/policy.py -+++ b/udica/policy.py -@@ -284,7 +284,7 @@ def write_policy_for_crio_mounts(mounts, policy): - + " ))) \n" - ) - -- for contexts in sorted(set(contexts_readonly)): -+ for context in sorted(set(contexts_readonly)): - policy.write( - " (allow process " - + context --- -2.38.1 - diff --git a/sources b/sources index a1cf679..09d2fca 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.7.tar.gz) = 03ff95f80317d09f980f89a7c415f0aeb6de965e64e9179969d2361d6a62ad243987e0355453a2c4ce4f4086834ea651644ccaa7eff1d82926000373040fa21d +SHA512 (v0.2.8.tar.gz) = 513d932cad65d75b5aa753f2b0e4a99c0f5fa930740c65c20343521bc74deca13b140a69b78ab001dcd144a14254d1dda8ca8989531070e545fddbb08c1e64f0 diff --git a/udica.spec b/udica.spec index 557bf3a..1a7a9fc 100644 --- a/udica.spec +++ b/udica.spec @@ -1,16 +1,9 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.7 -Release: 7%{?dist} +Version: 0.2.8 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N 4a64ff7c1b8116a1894e72eee2a19706e970001f -- . ':!.cirrus.yml' ':!.github' -Patch0001: 0001-Add-device-access-option.patch -Patch0002: 0002-Syntax-changes-after-running-black.patch -Patch0003: 0003-Add-unit-test-for-device-access.patch -Patch0004: 0004-Rename-device-access-to-devices.patch -Patch0005: 0005-Show-diff-when-checking-formatting.patch -Patch0006: 0006-Fix-several-lint-findings.patch -Patch0007: 0007-Fix-generating-policy-for-Crio-mounts.patch License: GPL-3.0-or-later BuildArch: noarch Url: https://github.com/containers/udica @@ -66,6 +59,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Nov 29 2023 Vit Mojzis - 0.2.8-1 +- New release + * Sat Jul 22 2023 Fedora Release Engineering - 0.2.7-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From a3c99dc617824ef29d5b6905d96c007459514d78 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 21 Dec 2023 00:08:06 +0100 Subject: [PATCH 63/80] udica-0.2.8-2 - Add option to generate custom policy for a confined user --- ...nerate-custom-policy-for-a-confined-.patch | 4923 +++++++++++++++++ ...ring-confined-user-policy-generation.patch | 170 + udica.spec | 12 +- 3 files changed, 5103 insertions(+), 2 deletions(-) create mode 100644 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch create mode 100644 0002-Add-tests-covering-confined-user-policy-generation.patch diff --git a/0001-Add-option-to-generate-custom-policy-for-a-confined-.patch b/0001-Add-option-to-generate-custom-policy-for-a-confined-.patch new file mode 100644 index 0000000..d18dbbc --- /dev/null +++ b/0001-Add-option-to-generate-custom-policy-for-a-confined-.patch @@ -0,0 +1,4923 @@ +From 21aa1fb602540d26e3ccad46ab59922da1810dd8 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Wed, 29 Nov 2023 10:38:48 +0100 +Subject: [PATCH] Add option to generate custom policy for a confined user +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Udica can now generate cil policy for a confined user using a list of +macros. +The macros are based on policy templates created by Patrik Končitý: +https://github.com/Koncpa/confined-users-policy + +Signed-off-by: Vit Mojzis +--- + setup.py | 1 + + udica/__main__.py | 332 +- + udica/confined_user.py | 134 + + udica/macros/confined_user_macros.cil | 4367 +++++++++++++++++++++++++ + 4 files changed, 4719 insertions(+), 115 deletions(-) + create mode 100644 udica/confined_user.py + create mode 100644 udica/macros/confined_user_macros.cil + +diff --git a/setup.py b/setup.py +index deb6457..d3f20f4 100644 +--- a/setup.py ++++ b/setup.py +@@ -37,6 +37,7 @@ setuptools.setup( + data_files=[ + ("/usr/share/licenses/udica", ["LICENSE"]), + ("/usr/share/udica/ansible", ["udica/ansible/deploy-module.yml"]), ++ ("/usr/share/udica/macros", ["udica/macros/confined_user_macros.cil"]), + ], + # scripts=["bin/udica"], + entry_points={"console_scripts": ["udica=udica.__main__:main"]}, +diff --git a/udica/__main__.py b/udica/__main__.py +index 43d2e43..2bbd401 100644 +--- a/udica/__main__.py ++++ b/udica/__main__.py +@@ -13,8 +13,9 @@ + # You should have received a copy of the GNU General Public License + # along with this program. If not, see . + +-import subprocess + import argparse ++import subprocess ++import sys + + # import udica + from udica.parse import parse_avc_file +@@ -25,116 +26,214 @@ from udica.policy import create_policy, load_policy, generate_playbook + + + def get_args(): +- parser = argparse.ArgumentParser( +- description="Script generates SELinux policy for running container." +- ) +- parser.add_argument("-V", "--version", action="version", version=version) +- parser.add_argument( +- type=str, help="Name for SELinux policy module", dest="ContainerName" +- ) +- parser.add_argument( +- "-i", +- "--container-id", +- type=str, +- help="Running container ID", +- dest="ContainerID", +- default=None, +- ) +- parser.add_argument( +- "-j", +- "--json", +- help='Load json from this file, use "-j -" for stdin', +- required=False, +- dest="JsonFile", +- default=None, +- ) +- parser.add_argument( +- "--full-network-access", +- help="Allow container full Network access ", +- required=False, +- dest="FullNetworkAccess", +- action="store_true", +- ) +- parser.add_argument( +- "--tty-access", +- help="Allow container to read and write the controlling terminal ", +- required=False, +- dest="TtyAccess", +- action="store_true", +- ) +- parser.add_argument( +- "--X-access", +- help="Allow container to communicate with Xserver ", +- required=False, +- dest="XAccess", +- action="store_true", +- ) +- parser.add_argument( +- "--virt-access", +- help="Allow container to communicate with libvirt ", +- required=False, +- dest="VirtAccess", +- action="store_true", +- ) +- parser.add_argument( +- "-s", +- "--stream-connect", +- help="Allow container to stream connect with given SELinux domain ", +- required=False, +- dest="StreamConnect", +- ) +- parser.add_argument( +- "-l", +- "--load-modules", +- help="Load templates and module created by this tool ", +- required=False, +- dest="LoadModules", +- action="store_true", +- ) +- parser.add_argument( +- "-c", +- "--caps", +- help='List of capabilities, e.g "-c AUDIT_WRITE,CHOWN,DAC_OVERRIDE,FOWNER,FSETID,KILL,MKNOD,NET_BIND_SERVICE,NET_RAW,SETFCAP,SETGID,SETPCAP,SETUID,SYS_CHROOT"', +- required=False, +- dest="Caps", +- default=None, +- ) +- parser.add_argument( +- "--devices", +- type=str, +- help='List of devices the container should have access to, e.g "--devices /dev/dri/card0,/dev/dri/renderD128"', +- dest="Devices", +- required=False, +- default=None, +- ) +- parser.add_argument( +- "-d", +- "--ansible", +- help="Generate ansible playbook to deploy SELinux policy for containers ", +- required=False, +- dest="Ansible", +- action="store_true", +- ) +- parser.add_argument( +- "-a", +- "--append-rules", +- type=str, +- help="Append more SELinux allow rules from file", +- dest="FileAVCS", +- required=False, +- default=None, +- ) +- parser.add_argument( +- "-e", +- "--container-engine", +- type=str, +- help="Specify which container engine is used for the inspected container (supports: {})".format( +- ", ".join(ENGINE_ALL) +- ), +- dest="ContainerEngine", +- required=False, +- default="-", +- ) ++ if "confined_user" in sys.argv: ++ # set up confined_user parser (do not show normal "udica" options) ++ parser = argparse.ArgumentParser( ++ description="SELinux confined user policy generator" ++ ) ++ parser.add_argument("confined_user") ++ parser.add_argument( ++ "-a", ++ "--admin_commands", ++ action="store_true", ++ default=False, ++ dest="admin_commands", ++ help="Use administrative commands (vipw, passwd, ...)", ++ ) ++ parser.add_argument( ++ "-g", ++ "--graphical_login", ++ action="store_true", ++ default=False, ++ dest="graphical_login", ++ help="Use graphical login environment", ++ ) ++ parser.add_argument( ++ "-m", ++ "--mozilla_usage", ++ action="store_true", ++ default=False, ++ dest="mozilla_usage", ++ help="Use mozilla firefox", ++ ) ++ parser.add_argument( ++ "-n", ++ "--networking", ++ action="store_true", ++ default=False, ++ dest="networking", ++ help="Manage basic networking (ip, ifconfig, traceroute, tcpdump, ...)", ++ ) ++ parser.add_argument( ++ "-d", ++ "--security_advanced", ++ action="store_true", ++ default=False, ++ dest="security_advanced", ++ help="Manage SELinux settings (semanage, semodule, sepolicy, ...)", ++ ) ++ parser.add_argument( ++ "-i", ++ "--security_basic", ++ action="store_true", ++ default=False, ++ dest="security_basic", ++ help="Use read-only security-related tools (seinfo, getsebool, sesearch, ...)", ++ ) ++ parser.add_argument( ++ "-s", ++ "--sudo", ++ action="store_true", ++ default=False, ++ dest="sudo", ++ help="Run commands as root using sudo", ++ ) ++ parser.add_argument( ++ "-l", ++ "--user_login", ++ action="store_true", ++ default=False, ++ dest="user_login", ++ help="Basic rules common to all users (tty, pty, ...)", ++ ) ++ parser.add_argument( ++ "-c", ++ "--ssh_connect", ++ action="store_true", ++ default=False, ++ dest="ssh_connect", ++ help="Connect over SSH", ++ ) ++ parser.add_argument( ++ "-b", ++ "--basic_commands", ++ action="store_true", ++ default=False, ++ dest="basic_commands", ++ help="Use basic commands (date, ls, ps, man, systemctl -user, journalctl -user, passwd, ...)", ++ ) ++ parser.add_argument("--level", nargs="?", default="s0", dest="level") ++ parser.add_argument( ++ "--range", nargs="?", default="s0-s0:c0.c1023", dest="range" ++ ) ++ parser.add_argument("uname") ++ else: ++ # set up normal udica parser ++ parser = argparse.ArgumentParser( ++ description="Script generates SELinux policy for running container.", ++ prog="udica [confined_user]", ++ formatter_class=argparse.RawDescriptionHelpFormatter, ++ epilog="""Additional options: ++ confined_user Generate policy for a new confined user instead of a container policy""", ++ ) ++ parser.add_argument("-V", "--version", action="version", version=version) ++ parser.add_argument( ++ type=str, help="Name for SELinux policy module", dest="ContainerName" ++ ) ++ parser.add_argument( ++ "-i", ++ "--container-id", ++ type=str, ++ help="Running container ID", ++ dest="ContainerID", ++ default=None, ++ ) ++ parser.add_argument( ++ "-j", ++ "--json", ++ help='Load json from this file, use "-j -" for stdin', ++ required=False, ++ dest="JsonFile", ++ default=None, ++ ) ++ parser.add_argument( ++ "--full-network-access", ++ help="Allow container full Network access ", ++ required=False, ++ dest="FullNetworkAccess", ++ action="store_true", ++ ) ++ parser.add_argument( ++ "--tty-access", ++ help="Allow container to read and write the controlling terminal ", ++ required=False, ++ dest="TtyAccess", ++ action="store_true", ++ ) ++ parser.add_argument( ++ "--X-access", ++ help="Allow container to communicate with Xserver ", ++ required=False, ++ dest="XAccess", ++ action="store_true", ++ ) ++ parser.add_argument( ++ "--virt-access", ++ help="Allow container to communicate with libvirt ", ++ required=False, ++ dest="VirtAccess", ++ action="store_true", ++ ) ++ parser.add_argument( ++ "-s", ++ "--stream-connect", ++ help="Allow container to stream connect with given SELinux domain ", ++ required=False, ++ dest="StreamConnect", ++ ) ++ parser.add_argument( ++ "-l", ++ "--load-modules", ++ help="Load templates and module created by this tool ", ++ required=False, ++ dest="LoadModules", ++ action="store_true", ++ ) ++ parser.add_argument( ++ "-c", ++ "--caps", ++ help='List of capabilities, e.g "-c AUDIT_WRITE,CHOWN,DAC_OVERRIDE,FOWNER,FSETID,KILL,MKNOD,NET_BIND_SERVICE,NET_RAW,SETFCAP,SETGID,SETPCAP,SETUID,SYS_CHROOT"', ++ required=False, ++ dest="Caps", ++ default=None, ++ ) ++ parser.add_argument( ++ "--devices", ++ type=str, ++ help='List of devices the container should have access to, e.g "--devices /dev/dri/card0,/dev/dri/renderD128"', ++ dest="Devices", ++ required=False, ++ default=None, ++ ) ++ parser.add_argument( ++ "-d", ++ "--ansible", ++ help="Generate ansible playbook to deploy SELinux policy for containers ", ++ required=False, ++ dest="Ansible", ++ action="store_true", ++ ) ++ parser.add_argument( ++ "-a", ++ "--append-rules", ++ type=str, ++ help="Append more SELinux allow rules from file", ++ dest="FileAVCS", ++ required=False, ++ default=None, ++ ) ++ parser.add_argument( ++ "-e", ++ "--container-engine", ++ type=str, ++ help="Specify which container engine is used for the inspected container (supports: {})".format( ++ ", ".join(ENGINE_ALL) ++ ), ++ dest="ContainerEngine", ++ required=False, ++ default="-", ++ ) ++ + args = parser.parse_args() + return vars(args) + +@@ -142,6 +241,13 @@ def get_args(): + def main(): + opts = get_args() + ++ # generate confined user policy ++ if "confined_user" in opts.keys(): ++ from udica.confined_user import create_confined_user_policy ++ ++ create_confined_user_policy(opts) ++ return ++ + if opts["ContainerID"]: + container_inspect_raw = None + for backend in [ENGINE_PODMAN, ENGINE_DOCKER]: +@@ -167,8 +273,6 @@ def main(): + + if opts["JsonFile"]: + if opts["JsonFile"] == "-": +- import sys +- + container_inspect_raw = sys.stdin.read() + else: + import os.path +@@ -182,8 +286,6 @@ def main(): + + if (not opts["JsonFile"]) and (not opts["ContainerID"]): + try: +- import sys +- + container_inspect_raw = sys.stdin.read() + except Exception as e: + print("Couldn't parse inspect data from stdin:", e) +diff --git a/udica/confined_user.py b/udica/confined_user.py +new file mode 100644 +index 0000000..796f543 +--- /dev/null ++++ b/udica/confined_user.py +@@ -0,0 +1,134 @@ ++# Copyright (C) 2023 Vit Mojzis, ++# ++# This program is free software; you can redistribute it and/or ++# modify it under the terms of the GNU General Public License as ++# published by the Free Software Foundation; either version 2 of ++# the License, or (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++ ++MACRO_CALLS = { ++ "admin_commands": ( ++ "(call confinedom_admin_commands_macro ({}))", ++ ("_t", "_r", "_sudo_t"), ++ ), ++ "graphical_login": ( ++ "(call confinedom_graphical_login_macro ({}))", ++ ("_t", "_r", "_dbus_t"), ++ ), ++ "mozilla_usage": ("(call confinedom_mozilla_usage_macro ({}))", ("_t", "_r")), ++ "networking": ("(call confinedom_networking_macro ({}))", ("_t", "_r")), ++ "security_advanced": ( ++ "(call confinedom_security_advanced_macro ({}))", ++ ("_t", "_r", "_sudo_t", "_userhelper_t"), ++ ), ++ "security_basic": ("(call confinedom_security_basic_macro ({}))", ("_t", "_r")), ++ "sudo": ( ++ "(call confinedom_sudo_macro ({}))", ++ ("_t", "_r", "_sudo_t", "_sudo_tmp_t"), ++ ), ++ "user_login": ( ++ "(call confinedom_user_login_macro ({}))", ++ ("_t", "_r", "_gkeyringd_t", "_dbus_t", "_exec_content"), ++ ), ++ "ssh_connect": ( ++ "(call confined_ssh_connect_macro ({}))", ++ ("_t", "_r", "_ssh_agent_t"), ++ ), ++ "basic_commands": ("(call confined_use_basic_commands_macro ({}))", ("_t", "_r")), ++} ++ ++TYPE_DEFS = { ++ "_t": "(type {}_t)", ++ "_r": "(role {}_r)", ++ "_dbus_t": "(type {}_dbus_t)", ++ "_gkeyringd_t": "(type {}_gkeyringd_t)", ++ "_ssh_agent_t": "(type {}_ssh_agent_t)", ++ "_sudo_t": "(type {}_sudo_t)", ++ "_sudo_tmp_t": "(type {}_sudo_tmp_t)", ++ "_userhelper_t": "(type {}_userhelper_t)", ++ "_exec_content": "(boolean {}_exec_content true)", ++} ++ ++ ++def create_confined_user_policy(opts): ++ # MCS/MLS range handling - needs to be separated into up-to 4 parts ++ # s0-s15:c0.c1023 -> (userrange {uname}_u ((s0 ) (s15 (range c0 c1023)))) ++ # s0:c0 -> (userrange {uname}_u ((s0 ) (s0 (c0)))) ++ mls_range = opts["range"] ++ mcs_range = "" ++ # separate MCS portion ++ if ":" in opts["range"]: ++ # s0:c0.c1023 ++ (mls_range, mcs_range) = opts["range"].split(":") ++ if "-" in mls_range: ++ # s0-s15 ++ (range_l, range_h) = mls_range.split("-") ++ else: ++ # s0 ++ range_l = mls_range ++ range_h = range_l ++ if mcs_range != "": ++ if "." in mcs_range: ++ # s0:c0.c1023 -> (userrange {uname}_u ((s0 ) (s0 (range c0 c1023)))) ++ (mcs_range_l, mcs_range_h) = mcs_range.split(".") ++ mcs_range = "(range {} {})".format(mcs_range_l, mcs_range_h) ++ else: ++ # s0:c0 -> (userrange {uname}_u ((s0 ) (s0 (c0)))) ++ mcs_range = "({})".format(mcs_range) ++ ++ range = "({} ) ({} {})".format(range_l, range_h, mcs_range) ++ ++ defs = set() ++ ++ policy = """ ++(user {uname}_u) ++(userrole {uname}_u {uname}_r) ++(userlevel {uname}_u ({level})) ++(userrange {uname}_u ({range})) ++""".format( ++ uname=opts["uname"], level=opts["level"], range=range ++ ) ++ ++ # process arguments determining which macros are to be used ++ for arg, value in opts.items(): ++ if not value or arg not in MACRO_CALLS.keys(): ++ continue ++ for param in MACRO_CALLS[arg][1]: ++ defs.add(TYPE_DEFS[param].format(opts["uname"])) ++ policy += "\n" + ( ++ MACRO_CALLS[arg][0].format( ++ " ".join([opts["uname"] + s for s in MACRO_CALLS[arg][1]]) ++ ) ++ ) ++ # print("{}: {}".format(arg, value)) ++ ++ policy = "\n".join(sorted(defs)) + policy ++ ++ with open("{}.cil".format(opts["uname"]), "w") as f: ++ f.write(policy) ++ ++ print("Created {}.cil".format(opts["uname"])) ++ print("Run the following commands to apply the new policy:") ++ print("Install the new policy module") ++ print( ++ "# semodule -i {}.cil /usr/share/udica/macros/confined_user_macros.cil".format( ++ opts["uname"] ++ ) ++ ) ++ print("Create a default context file for the new user") ++ print( ++ "# sed -e ’s|user|{}|g’ /etc/selinux/targeted/contexts/users/user_u > /etc/selinux/targeted/contexts/users/{}_u".format( ++ opts["uname"], opts["uname"] ++ ) ++ ) ++ print("Map the new selinux user to an existing user account") ++ print("# semanage login -a -s {}_u {}".format(opts["uname"], opts["uname"])) ++ print("Fix labels in the user's home direcotry") ++ print("# restorecon -RvF /home/{}".format(opts["uname"])) +diff --git a/udica/macros/confined_user_macros.cil b/udica/macros/confined_user_macros.cil +new file mode 100644 +index 0000000..ddb5689 +--- /dev/null ++++ b/udica/macros/confined_user_macros.cil +@@ -0,0 +1,4367 @@ ++(typeattribute login_confinedom) ++ ++(optional confined_transition_userdomain_optional ++ (typeattributeset cil_gen_require init_t) ++ (typeattributeset cil_gen_require xdm_t) ++ (typeattributeset cil_gen_require login_confinedom) ++ (typeattributeset cil_gen_require xsession_exec_t) ++ (allow xdm_t xsession_exec_t (file (ioctl read getattr map execute open))) ++ (allow xdm_t login_confinedom (process (transition))) ++ (allow login_confinedom xdm_t (fd (use))) ++ (allow login_confinedom xdm_t (fifo_file (ioctl read write getattr lock append open))) ++ (allow login_confinedom xdm_t (process (sigchld))) ++) ++ ++(optional confined_xsession_spec_domtrans_conf_users_optional ++ (typeattributeset cil_gen_require init_t) ++ (typeattributeset cil_gen_require xdm_t) ++ (typeattributeset cil_gen_require login_confinedom) ++ (allow init_t login_confinedom (process (transition))) ++) ++ ++(macro confinedom_admin_commands_macro ((type utype) (role urole) (type sudo_type)) ++ (optional confinedom_admin_commands_optional_2 ++ (roleattributeset cil_gen_require urole) ++ (roleattributeset cil_gen_require iptables_roles) ++ (typeattributeset cil_gen_require utype) ++ (typeattributeset cil_gen_require sudo_type) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset cil_gen_require usbmon_device_t) ++ (typeattributeset cil_gen_require device_t) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require selinux_config_t) ++ (typeattributeset cil_gen_require policy_config_t) ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require modules_object_t) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require files_unconfined_type) ++ (typeattributeset cil_gen_require init_var_run_t) ++ (typeattributeset cil_gen_require init_var_lib_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require init_t) ++ (typeattributeset cil_gen_require iptables_t) ++ (typeattributeset cil_gen_require iptables_exec_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require proc_t) ++ (typeattributeset cil_gen_require proc_net_t) ++ (typeattributeset cil_gen_require auditd_t) ++ (typeattributeset cil_gen_require auditd_etc_t) ++ (typeattributeset cil_gen_require auditd_log_t) ++ (typeattributeset cil_gen_require auditd_var_run_t) ++ (typeattributeset cil_gen_require auditd_initrc_exec_t) ++ (typeattributeset cil_gen_require auditd_unit_file_t) ++ (typeattributeset cil_gen_require auditctl_t) ++ (typeattributeset cil_gen_require auditctl_exec_t) ++ (typeattributeset cil_gen_require initrc_t) ++ (typeattributeset cil_gen_require initrc_transition_domain) ++ (typeattributeset cil_gen_require filesystem_type) ++ (typeattributeset cil_gen_require can_system_change) ++ (typeattributeset cil_gen_require systemd_systemctl_exec_t) ++ (typeattributeset cil_gen_require cgroup_t) ++ (typeattributeset cil_gen_require tmpfs_t) ++ (typeattributeset cil_gen_require sysfs_t) ++ (typeattributeset cil_gen_require efivarfs_t) ++ (typeattributeset cil_gen_require systemd_unit_file_type) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require systemd_logind_var_run_t) ++ (typeattributeset cil_gen_require systemd_passwd_agent_t) ++ (typeattributeset cil_gen_require systemd_passwd_agent_exec_t) ++ (typeattributeset cil_gen_require systemd_passwd_var_run_t) ++ (typeattributeset cil_gen_require syslogd_t) ++ (typeattributeset cil_gen_require klogd_t) ++ (typeattributeset cil_gen_require syslog_conf_t) ++ (typeattributeset cil_gen_require syslogd_tmp_t) ++ (typeattributeset cil_gen_require syslogd_var_lib_t) ++ (typeattributeset cil_gen_require syslogd_var_run_t) ++ (typeattributeset cil_gen_require klogd_var_run_t) ++ (typeattributeset cil_gen_require klogd_tmp_t) ++ (typeattributeset cil_gen_require var_log_t) ++ (typeattributeset cil_gen_require syslogd_initrc_exec_t) ++ (typeattributeset cil_gen_require logfile) ++ (typeattributeset cil_gen_require user_home_dir_t) ++ (typeattributeset cil_gen_require user_home_t) ++ (typeattributeset cil_gen_require user_home_type) ++ (typeattributeset cil_gen_require home_root_t) ++ (typeattributeset cil_gen_require passwd_t) ++ (typeattributeset cil_gen_require passwd_exec_t) ++ (roleattributeset cil_gen_require iptables_roles) ++ (roleattributeset iptables_roles (urole )) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole auditctl_t) ++ (typeattributeset cil_gen_require initrc_transition_domain) ++ (typeattributeset initrc_transition_domain (utype )) ++ (typeattributeset cil_gen_require files_unconfined_type) ++ (typeattributeset files_unconfined_type (utype )) ++ (typeattributeset cil_gen_require can_system_change) ++ (typeattributeset can_system_change (utype )) ++ (allow utype self (capability (net_raw))) ++ (allow utype self (netlink_generic_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow utype self (netlink_netfilter_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow utype self (netlink_rdma_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow utype self (packet_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow utype self (packet_socket (map))) ++ (allow sudo_type utype (unix_stream_socket (connectto))) ++ (allow sudo_type self (bluetooth_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow sudo_type self (capability (net_raw))) ++ (allow sudo_type self (netlink_generic_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow sudo_type self (netlink_netfilter_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow sudo_type self (netlink_rdma_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow sudo_type self (packet_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow sudo_type self (packet_socket (map))) ++ (allow utype domain (process (getattr))) ++ (allow utype usbmon_device_t (chr_file (map))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype usbmon_device_t (chr_file (ioctl read getattr lock open))) ++ (allow sudo_type non_auth_file_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type non_auth_file_type (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow sudo_type non_auth_file_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type non_auth_file_type (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow sudo_type non_auth_file_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type non_auth_file_type (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow sudo_type non_auth_file_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type non_auth_file_type (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow sudo_type non_auth_file_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type non_auth_file_type (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow sudo_type etc_t (dir (getattr open search))) ++ (allow sudo_type selinux_config_t (dir (getattr open search))) ++ (allow sudo_type policy_config_t (dir (ioctl write getattr lock open add_name search))) ++ (allow sudo_type policy_config_t (file (create getattr open))) ++ (allow sudo_type policy_config_t (dir (getattr open search))) ++ (allow sudo_type policy_config_t (file (ioctl write getattr lock append open))) ++ (allow sudo_type modules_object_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type modules_object_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow sudo_type file_type (dir (ioctl read getattr lock open search))) ++ (allow sudo_type file_type (dir (getattr open search))) ++ (allow sudo_type file_type (lnk_file (read getattr))) ++ (allow sudo_type init_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type init_var_run_t (dir (ioctl write getattr lock open add_name search))) ++ (allow sudo_type init_var_run_t (dir (create getattr))) ++ (allow sudo_type var_t (dir (getattr open search))) ++ (allow sudo_type var_lib_t (dir (getattr open search))) ++ (allow sudo_type init_var_lib_t (dir (getattr open search))) ++ (allow sudo_type init_var_lib_t (file (ioctl read getattr map open))) ++ (allow sudo_type init_t (dir (getattr open search))) ++ (allow sudo_type init_t (file (ioctl read getattr lock open))) ++ (allow sudo_type init_t (lnk_file (read getattr))) ++ (allow sudo_type init_var_run_t (sock_file (write))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype iptables_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype iptables_t (process (transition))) ++ (typetransition utype iptables_exec_t process iptables_t) ++ (allow iptables_t utype (fd (use))) ++ (allow iptables_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow iptables_t utype (process (sigchld))) ++ (allow utype iptables_exec_t (file (map))) ++ (allow sudo_type proc_t (dir (getattr open search))) ++ (allow sudo_type proc_net_t (dir (getattr open search))) ++ (allow sudo_type proc_net_t (file (ioctl read getattr lock open))) ++ (allow sudo_type proc_t (dir (getattr open search))) ++ (allow sudo_type proc_net_t (dir (getattr open search))) ++ (allow sudo_type proc_net_t (lnk_file (read getattr))) ++ (allow sudo_type proc_t (dir (getattr open search))) ++ (allow sudo_type proc_net_t (dir (ioctl read getattr lock open search))) ++ (allow utype auditd_t (process (sigchld sigkill sigstop signull signal))) ++ (allow utype auditd_t (dir (ioctl read getattr lock open search))) ++ (allow utype auditd_t (file (ioctl read getattr lock open))) ++ (allow utype auditd_t (lnk_file (read getattr))) ++ (allow utype auditd_t (process (getattr))) ++ (allow utype auditd_etc_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype auditd_etc_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype auditd_etc_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype auditd_etc_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype auditd_log_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype auditd_log_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype auditd_log_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype auditd_log_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype auditd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype auditd_var_run_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype auditd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype auditd_var_run_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype auditctl_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype auditctl_t (process (transition))) ++ (typetransition utype auditctl_exec_t process auditctl_t) ++ (allow auditctl_t utype (fd (use))) ++ (allow auditctl_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow auditctl_t utype (process (sigchld))) ++ (allow utype filesystem_type (dir (getattr open search))) ++ (allow utype auditd_initrc_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype initrc_t (process (transition))) ++ (typetransition utype auditd_initrc_exec_t process initrc_t) ++ (allow initrc_t utype (fd (use))) ++ (allow initrc_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow initrc_t utype (process (sigchld))) ++ (allow utype auditd_initrc_exec_t (file (ioctl))) ++ (allow utype etc_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype systemd_systemctl_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (dir (ioctl read getattr lock open search))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (file (ioctl read getattr lock open))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (lnk_file (read getattr))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype efivarfs_t (dir (getattr open search))) ++ (allow utype efivarfs_t (file (ioctl read getattr lock open))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype systemd_unit_file_type (dir (ioctl read getattr lock open search))) ++ (allow utype init_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow utype init_t (dir (getattr open search))) ++ (allow utype init_t (file (ioctl read getattr lock open))) ++ (allow utype init_t (lnk_file (read getattr))) ++ (allow utype init_t (unix_stream_socket (sendto))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype init_var_run_t (dir (getattr open search))) ++ (allow utype init_var_run_t (sock_file (write getattr append open))) ++ (allow utype init_t (unix_stream_socket (connectto))) ++ (allow utype init_t (unix_stream_socket (getattr))) ++ (dontaudit utype self (process (setrlimit))) ++ (dontaudit utype self (capability (sys_resource))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (file (ioctl read getattr lock open))) ++ (allow utype systemd_passwd_agent_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype init_var_run_t (dir (getattr open search))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow systemd_passwd_agent_t utype (process (signull))) ++ (allow systemd_passwd_agent_t utype (unix_dgram_socket (sendto))) ++ (dontaudit utype self (capability (net_admin sys_ptrace))) ++ (allow utype auditd_unit_file_t (file (ioctl read getattr lock open))) ++ (allow utype auditd_unit_file_t (service (start stop status reload enable disable))) ++ (allow utype auditd_t (dir (ioctl read getattr lock open search))) ++ (allow utype auditd_t (file (ioctl read getattr lock open))) ++ (allow utype auditd_t (lnk_file (read getattr))) ++ (allow utype auditd_t (process (getattr))) ++ (allow utype auditd_unit_file_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype auditd_unit_file_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype auditd_unit_file_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype auditd_unit_file_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype auditd_unit_file_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype auditd_unit_file_t (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow utype auditd_unit_file_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype auditd_unit_file_t (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype auditd_unit_file_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype auditd_unit_file_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype auditd_unit_file_t (dir (getattr open search))) ++ (allow utype auditd_unit_file_t (dir (getattr relabelfrom relabelto))) ++ (allow utype auditd_unit_file_t (dir (getattr open search))) ++ (allow utype auditd_unit_file_t (file (getattr relabelfrom relabelto))) ++ (allow utype auditd_unit_file_t (dir (getattr open search))) ++ (allow utype auditd_unit_file_t (lnk_file (getattr relabelfrom relabelto))) ++ (allow utype auditd_unit_file_t (dir (getattr open search))) ++ (allow utype auditd_unit_file_t (fifo_file (getattr relabelfrom relabelto))) ++ (allow utype auditd_unit_file_t (dir (getattr open search))) ++ (allow utype auditd_unit_file_t (sock_file (getattr relabelfrom relabelto))) ++ (allow utype auditd_unit_file_t (service (start stop status reload enable disable))) ++ (allow utype self (capability2 (syslog))) ++ (allow utype syslogd_t (process (sigchld sigkill sigstop signull signal))) ++ (allow utype klogd_t (process (sigchld sigkill sigstop signull signal))) ++ (allow utype syslogd_t (dir (ioctl read getattr lock open search))) ++ (allow utype syslogd_t (file (ioctl read getattr lock open))) ++ (allow utype syslogd_t (lnk_file (read getattr))) ++ (allow utype syslogd_t (process (getattr))) ++ (allow utype klogd_t (dir (ioctl read getattr lock open search))) ++ (allow utype klogd_t (file (ioctl read getattr lock open))) ++ (allow utype klogd_t (lnk_file (read getattr))) ++ (allow utype klogd_t (process (getattr))) ++ (allow utype klogd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype klogd_var_run_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype klogd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype klogd_var_run_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype klogd_tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype klogd_tmp_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype klogd_tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype klogd_tmp_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype syslogd_tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype syslogd_tmp_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype syslogd_tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype syslogd_tmp_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype syslog_conf_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype syslog_conf_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype syslog_conf_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype syslog_conf_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype etc_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (typetransition utype etc_t file syslog_conf_t) ++ (allow utype syslogd_var_lib_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype syslogd_var_lib_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype syslogd_var_lib_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype syslogd_var_lib_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype syslogd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype syslogd_var_run_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype syslogd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype syslogd_var_run_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype logfile (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype logfile (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype logfile (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype logfile (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype logfile (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow utype logfile (file (map))) ++ (allow utype logfile (dir (getattr relabelfrom relabelto))) ++ (allow utype logfile (file (getattr relabelfrom relabelto))) ++ (allow utype filesystem_type (dir (getattr open search))) ++ (allow utype syslogd_initrc_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype initrc_t (process (transition))) ++ (typetransition utype syslogd_initrc_exec_t process initrc_t) ++ (allow initrc_t utype (fd (use))) ++ (allow initrc_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow initrc_t utype (process (sigchld))) ++ (allow utype syslogd_initrc_exec_t (file (ioctl))) ++ (allow utype etc_t (dir (getattr open search))) ++ (allow sudo_type home_root_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type home_root_t (lnk_file (read getattr))) ++ (allow sudo_type user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type user_home_type (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow sudo_type user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type user_home_type (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow sudo_type user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type user_home_type (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow sudo_type user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type user_home_type (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow sudo_type user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type user_home_type (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow sudo_type user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (typetransition sudo_type user_home_dir_t fifo_file user_home_t) ++ (typetransition sudo_type user_home_dir_t sock_file user_home_t) ++ (typetransition sudo_type user_home_dir_t lnk_file user_home_t) ++ (typetransition sudo_type user_home_dir_t dir user_home_t) ++ (typetransition sudo_type user_home_dir_t file user_home_t) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (lnk_file (read getattr))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type passwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type passwd_t (process (transition))) ++ (typetransition sudo_type passwd_exec_t process passwd_t) ++ (allow passwd_t sudo_type (fd (use))) ++ (allow passwd_t sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow passwd_t sudo_type (process (sigchld))) ++ (roletransition urole syslogd_initrc_exec_t process system_r) ++ (roletransition urole auditd_initrc_exec_t process system_r) ++ (roleallow urole system_r) ++ (roleallow urole system_r) ++ (booleanif (deny_ptrace) ++ (false ++ (allow utype auditd_t (process (ptrace))) ++ (allow utype klogd_t (process (ptrace))) ++ (allow utype syslogd_t (process (ptrace))) ++ ) ++ ) ++ (optional confinedom_admin_commands_optional_3 ++ (typeattributeset cil_gen_require tuned_t) ++ (allow utype tuned_t (dbus (send_msg))) ++ (allow tuned_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_admin_commands_optional_4 ++ (roleattributeset cil_gen_require wireshark_roles) ++ (typeattributeset cil_gen_require user_home_dir_t) ++ (typeattributeset cil_gen_require home_root_t) ++ (typeattributeset cil_gen_require wireshark_t) ++ (typeattributeset cil_gen_require wireshark_exec_t) ++ (typeattributeset cil_gen_require wireshark_home_t) ++ (typeattributeset cil_gen_require wireshark_tmp_t) ++ (typeattributeset cil_gen_require wireshark_tmpfs_t) ++ (roleattributeset cil_gen_require wireshark_roles) ++ (roleattributeset wireshark_roles (urole )) ++ (allow utype wireshark_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype wireshark_t (process (transition))) ++ (typetransition utype wireshark_exec_t process wireshark_t) ++ (allow wireshark_t utype (fd (use))) ++ (allow wireshark_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow wireshark_t utype (process (sigchld))) ++ (allow utype wireshark_t (process (sigchld sigkill sigstop signull signal ptrace))) ++ (allow utype wireshark_t (dir (ioctl read getattr lock open search))) ++ (allow utype wireshark_t (file (ioctl read getattr lock open))) ++ (allow utype wireshark_t (lnk_file (read getattr))) ++ (allow utype wireshark_t (process (getattr))) ++ (allow utype wireshark_home_t (dir (ioctl read write create getattr setattr lock relabelfrom relabelto unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype wireshark_tmp_t (dir (ioctl read write create getattr setattr lock relabelfrom relabelto unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype wireshark_tmpfs_t (dir (ioctl read write create getattr setattr lock relabelfrom relabelto unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype wireshark_home_t (file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open watch watch_reads))) ++ (allow utype wireshark_tmp_t (file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open watch watch_reads))) ++ (allow utype wireshark_tmpfs_t (file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open watch watch_reads))) ++ (allow utype wireshark_home_t (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename watch watch_reads))) ++ (allow utype wireshark_tmpfs_t (lnk_file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename watch watch_reads))) ++ (allow utype wireshark_tmpfs_t (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open))) ++ (allow utype wireshark_tmpfs_t (fifo_file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype wireshark_t (shm (getattr read write associate unix_read unix_write lock))) ++ (typetransition utype user_home_dir_t dir ".wireshark" wireshark_home_t) ++ ) ++ ) ++) ++ ++(macro confinedom_graphical_login_macro ((type utype) (role urole) (type dbusd_type)) ++ ++ (optional confinedom_graphical_login_optional_2 ++ (roleattributeset cil_gen_require urole) ++ (typeattributeset cil_gen_require utype) ++ (typeattributeset cil_gen_require user_tmpfs_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require usr_t) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require port_type) ++ (typeattributeset cil_gen_require device_t) ++ (typeattributeset cil_gen_require sound_device_t) ++ (typeattributeset cil_gen_require event_device_t) ++ (typeattributeset cil_gen_require v4l_device_t) ++ (typeattributeset cil_gen_require wireless_device_t) ++ (typeattributeset cil_gen_require configfile) ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require home_root_t) ++ (typeattributeset cil_gen_require lib_t) ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require tmp_t) ++ (typeattributeset cil_gen_require init_t) ++ (typeattributeset cil_gen_require usbfs_t) ++ (typeattributeset cil_gen_require usb_device_t) ++ (typeattributeset cil_gen_require noxattrfs) ++ (typeattributeset cil_gen_require dosfs_t) ++ (typeattributeset cil_gen_require removable_device_t) ++ (typeattributeset cil_gen_require proc_t) ++ (typeattributeset cil_gen_require sysctl_t) ++ (typeattributeset cil_gen_require sysctl_dev_t) ++ (typeattributeset cil_gen_require fonts_t) ++ (typeattributeset cil_gen_require locale_t) ++ (typeattributeset cil_gen_require mount_t) ++ (typeattributeset cil_gen_require selinux_config_t) ++ (typeattributeset cil_gen_require default_context_t) ++ (typeattributeset cil_gen_require fuse_device_t) ++ (typeattributeset cil_gen_require user_tmp_t) ++ (typeattributeset cil_gen_require user_home_t) ++ (typeattributeset cil_gen_require user_home_dir_t) ++ (typeattributeset cil_gen_require user_home_type) ++ (typeattributeset cil_gen_require userdom_filetrans_type) ++ (typeattributeset cil_gen_require nfs_t) ++ (typeattributeset cil_gen_require autofs_t) ++ (typeattributeset cil_gen_require cifs_t) ++ (typeattributeset cil_gen_require xauth_t) ++ (typeattributeset cil_gen_require iceauth_t) ++ (typeattributeset cil_gen_require dridomain) ++ (typeattributeset cil_gen_require x_userdomain) ++ (typeattributeset cil_gen_require root_xdrawable_t) ++ (typeattributeset cil_gen_require xdm_t) ++ (typeattributeset cil_gen_require xserver_t) ++ (typeattributeset cil_gen_require xproperty_t) ++ (typeattributeset cil_gen_require user_xproperty_t) ++ (typeattributeset cil_gen_require xevent_t) ++ (typeattributeset cil_gen_require client_xevent_t) ++ (typeattributeset cil_gen_require input_xevent_t) ++ (typeattributeset cil_gen_require user_input_xevent_t) ++ (typeattributeset cil_gen_require x_domain) ++ (typeattributeset cil_gen_require input_xevent_type) ++ (typeattributeset cil_gen_require xdrawable_type) ++ (typeattributeset cil_gen_require xcolormap_type) ++ (typeattributeset cil_gen_require xdm_var_run_t) ++ (typeattributeset cil_gen_require tmpfs_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require userdomain) ++ (typeattributeset cil_gen_require xdm_log_t) ++ (typeattributeset cil_gen_require xdmhomewriter) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole user_home_dir_t) ++ (roletype urole user_home_type) ++ (roletype urole xauth_t) ++ (roletype urole iceauth_t) ++ (typeattributeset cil_gen_require xcolormap_type) ++ (typeattributeset xcolormap_type (utype )) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset file_type (bin_t usr_t )) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset non_security_file_type (bin_t usr_t )) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset exec_type (bin_t usr_t )) ++ (typeattributeset cil_gen_require xdmhomewriter) ++ (typeattributeset xdmhomewriter (utype )) ++ (typeattributeset cil_gen_require xdrawable_type) ++ (typeattributeset xdrawable_type (utype )) ++ (typeattributeset cil_gen_require userdom_filetrans_type) ++ (typeattributeset userdom_filetrans_type (utype )) ++ (typeattributeset cil_gen_require x_domain) ++ (typeattributeset x_domain (utype )) ++ (typeattributeset cil_gen_require x_userdomain) ++ (typeattributeset x_userdomain (utype )) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset entry_type (bin_t usr_t )) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset non_auth_file_type (bin_t usr_t )) ++ (typeattributeset cil_gen_require dridomain) ++ (typeattributeset dridomain (utype )) ++ (allow utype bin_t (file (entrypoint))) ++ (allow utype bin_t (file (ioctl read getattr lock map execute open))) ++ (allow utype usr_t (file (entrypoint))) ++ (allow utype usr_t (file (ioctl read getattr lock map execute open))) ++ (allow utype port_type (tcp_socket (name_connect))) ++ (allow utype utype (process (getattr setrlimit execmem))) ++ (allow utype utype (system (ipc_info syslog_read syslog_mod syslog_console module_request module_load halt reboot status start stop enable disable reload undefined))) ++ (allow utype utype (netlink_kobject_uevent_socket (read))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype sound_device_t (chr_file (ioctl write getattr lock append open))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype sound_device_t (chr_file (ioctl read getattr lock open))) ++ (allow utype sound_device_t (chr_file (map))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype event_device_t (chr_file (ioctl read write getattr lock append))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype v4l_device_t (chr_file (ioctl read getattr lock open))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype v4l_device_t (chr_file (ioctl write getattr lock append open))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype wireless_device_t (chr_file (ioctl read write getattr lock append open))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (dir (getattr watch))) ++ (allow utype configfile (dir (ioctl read getattr lock open search))) ++ (allow utype configfile (dir (getattr open search))) ++ (allow utype configfile (file (ioctl read getattr lock open))) ++ (allow utype configfile (dir (getattr open search))) ++ (allow utype configfile (lnk_file (read getattr))) ++ (allow utype etc_t (dir (getattr watch))) ++ (allow utype home_root_t (dir (getattr watch))) ++ (allow utype lib_t (dir (getattr watch))) ++ (allow utype usr_t (dir (getattr watch))) ++ (allow utype usr_t (file (getattr watch))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr watch))) ++ (allow utype var_run_t (dir (getattr watch))) ++ (allow utype tmp_t (dir (getattr watch))) ++ (allow utype init_t (unix_stream_socket (ioctl read write getattr setattr lock append bind connect listen accept getopt setopt shutdown))) ++ (allow utype proc_t (dir (getattr open search))) ++ (allow utype sysctl_t (dir (getattr open search))) ++ (allow utype sysctl_dev_t (dir (getattr open search))) ++ (allow utype sysctl_dev_t (file (ioctl read getattr lock open))) ++ (allow utype proc_t (dir (getattr open search))) ++ (allow utype sysctl_t (dir (getattr open search))) ++ (allow utype sysctl_dev_t (dir (ioctl read getattr lock open search))) ++ (allow utype fonts_t (dir (getattr watch))) ++ (allow utype locale_t (dir (getattr open search))) ++ (allow utype locale_t (lnk_file (getattr watch))) ++ (allow utype mount_t (process (signal))) ++ (allow utype etc_t (dir (getattr open search))) ++ (allow utype selinux_config_t (dir (getattr open search))) ++ (allow utype default_context_t (dir (ioctl read getattr lock open search))) ++ (allow utype default_context_t (dir (getattr open search))) ++ (allow utype default_context_t (file (ioctl read getattr lock open))) ++ (allow utype fuse_device_t (chr_file (ioctl read write getattr lock append open))) ++ (allow utype user_tmp_t (file (execute))) ++ (typemember utype user_home_dir_t dir user_home_dir_t) ++ (allow utype user_home_t (dir (mounton))) ++ (allow utype user_home_t (file (entrypoint))) ++ (allow utype user_home_type (file (relabelfrom relabelto))) ++ (allow utype user_home_type (dir (relabelfrom relabelto))) ++ (allow utype user_home_type (lnk_file (relabelfrom relabelto))) ++ (allow utype user_home_type (chr_file (relabelfrom relabelto))) ++ (allow utype user_home_type (blk_file (relabelfrom relabelto))) ++ (allow utype user_home_type (sock_file (relabelfrom relabelto))) ++ (allow utype user_home_type (fifo_file (relabelfrom relabelto))) ++ (allow utype user_home_dir_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype user_home_dir_t (dir (getattr open search))) ++ (allow utype user_home_type (dir (getattr open search))) ++ (allow utype user_home_type (dir (getattr relabelfrom relabelto))) ++ (allow utype user_home_dir_t (dir (getattr open search))) ++ (allow utype user_home_type (dir (getattr open search))) ++ (allow utype user_home_type (file (getattr relabelfrom relabelto))) ++ (allow utype user_home_dir_t (dir (getattr open search))) ++ (allow utype user_home_type (dir (getattr open search))) ++ (allow utype user_home_type (lnk_file (getattr relabelfrom relabelto))) ++ (allow utype user_home_dir_t (dir (getattr open search))) ++ (allow utype user_home_type (dir (getattr open search))) ++ (allow utype user_home_type (sock_file (getattr relabelfrom relabelto))) ++ (allow utype user_home_dir_t (dir (getattr open search))) ++ (allow utype user_home_type (dir (getattr open search))) ++ (allow utype user_home_type (fifo_file (getattr relabelfrom relabelto))) ++ (allow utype home_root_t (dir (ioctl read getattr lock open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write create getattr setattr lock relabelfrom relabelto unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype user_home_dir_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (typetransition utype root_xdrawable_t x_drawable utype) ++ (typetransition utype input_xevent_t x_event user_input_xevent_t) ++ (allow utype user_input_xevent_t (x_event (send))) ++ (allow utype user_input_xevent_t (x_synthetic_event (send))) ++ (allow utype user_input_xevent_t (x_event (receive))) ++ (allow utype user_input_xevent_t (x_synthetic_event (receive))) ++ (allow utype client_xevent_t (x_event (receive))) ++ (allow utype client_xevent_t (x_synthetic_event (receive))) ++ (allow utype xevent_t (x_event (send receive))) ++ (allow utype xevent_t (x_synthetic_event (send receive))) ++ (dontaudit utype input_xevent_type (x_event (send))) ++ (allow utype xdm_t (x_drawable (read add_child manage hide))) ++ (allow utype xdm_t (x_client (destroy))) ++ (allow utype root_xdrawable_t (x_drawable (write))) ++ (allow utype xserver_t (x_server (manage))) ++ (allow utype xserver_t (x_screen (saver_setattr saver_hide saver_show show_cursor hide_cursor))) ++ (allow utype xserver_t (x_pointer (get_property set_property manage))) ++ (allow utype xserver_t (x_keyboard (read manage freeze))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype tmp_t (dir (getattr open search))) ++ (allow utype tmp_t (lnk_file (read getattr))) ++ (allow utype tmp_t (dir (getattr open search))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype xdm_var_run_t (dir (getattr open search))) ++ (allow utype xdm_var_run_t (sock_file (write getattr append open))) ++ (allow utype xdm_t (unix_stream_socket (connectto))) ++ (allow utype user_tmp_t (dir (getattr open search))) ++ (allow utype user_tmp_t (sock_file (write getattr append open))) ++ (allow utype userdomain (unix_stream_socket (connectto))) ++ (allow utype xdm_log_t (file (getattr append))) ++ (booleanif (use_samba_home_dirs) ++ (true ++ (allow utype cifs_t (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype cifs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype cifs_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype cifs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype cifs_t (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow utype cifs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype cifs_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype cifs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype cifs_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype cifs_t (dir (mounton))) ++ (allow utype cifs_t (filesystem (mount))) ++ ) ++ ) ++ (booleanif (use_nfs_home_dirs) ++ (true ++ (allow utype nfs_t (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype nfs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype nfs_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype nfs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype nfs_t (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow utype nfs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype autofs_t (dir (getattr open search))) ++ (allow utype nfs_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype nfs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype autofs_t (dir (getattr open search))) ++ (allow utype nfs_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype autofs_t (dir (getattr open search))) ++ (allow utype nfs_t (dir (mounton))) ++ (allow utype nfs_t (filesystem (mount))) ++ ) ++ ) ++ (booleanif (selinuxuser_rw_noexattrfile) ++ (true ++ (allow utype removable_device_t (blk_file (ioctl write getattr lock append open))) ++ (allow utype device_t (lnk_file (read getattr))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (dir (ioctl read getattr lock open search))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype removable_device_t (blk_file (ioctl read getattr lock open))) ++ (allow utype device_t (lnk_file (read getattr))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (dir (ioctl read getattr lock open search))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype dosfs_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype dosfs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype dosfs_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype dosfs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype noxattrfs (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype noxattrfs (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype noxattrfs (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype usb_device_t (chr_file (ioctl read write getattr lock append open))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype usbfs_t (lnk_file (read getattr))) ++ (allow utype usbfs_t (dir (getattr open search))) ++ (allow utype usbfs_t (file (ioctl read write getattr lock append open))) ++ (allow utype usbfs_t (dir (getattr open search))) ++ (allow utype usbfs_t (dir (ioctl read getattr lock open search))) ++ (allow utype usbfs_t (dir (getattr open search))) ++ ) ++ ) ++ (optional confinedom_graphical_login_optional_3 ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require alsa_var_lib_t) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype alsa_var_lib_t (dir (getattr open search))) ++ (allow utype alsa_var_lib_t (file (ioctl read getattr lock open))) ++ ) ++ (optional confinedom_graphical_login_optional_4 ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require fwupd_cache_t) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype fwupd_cache_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype fwupd_cache_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ ) ++ (optional confinedom_graphical_login_optional_5 ++ ;(type dbusd_type) ++ (roletype object_r dbusd_type) ++ (typeattributeset cil_gen_require utype) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require usr_t) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require device_t) ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require system_dbusd_t) ++ (typeattributeset cil_gen_require session_dbusd_tmp_t) ++ (typeattributeset cil_gen_require dbusd_unconfined) ++ (typeattributeset cil_gen_require session_bus_type) ++ (typeattributeset cil_gen_require dbusd_exec_t) ++ (typeattributeset cil_gen_require dbusd_etc_t) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset cil_gen_require security_t) ++ (typeattributeset cil_gen_require sysfs_t) ++ (typeattributeset cil_gen_require userdom_home_manager_type) ++ (typeattributeset cil_gen_require shell_exec_t) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset cil_gen_require system_dbusd_var_run_t) ++ (typeattributeset cil_gen_require system_dbusd_var_lib_t) ++ (typeattributeset cil_gen_require urandom_device_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole dbusd_type) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset netlabel_peer_type (dbusd_type )) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset corenet_unlabeled_type (dbusd_type )) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset syslog_client_type (dbusd_type )) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset file_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset non_security_file_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset exec_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset application_domain_type (dbusd_type )) ++ (typeattributeset cil_gen_require userdom_home_manager_type) ++ (typeattributeset userdom_home_manager_type (dbusd_type )) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset ubac_constrained_type (dbusd_type )) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset kernel_system_state_reader (dbusd_type )) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset application_exec_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset nsswitch_domain (dbusd_type )) ++ (typeattributeset cil_gen_require session_bus_type) ++ (typeattributeset session_bus_type (dbusd_type )) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset entry_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset non_auth_file_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset domain (dbusd_type )) ++ (allow utype system_dbusd_t (dbus (acquire_svc))) ++ (allow utype session_dbusd_tmp_t (dir (ioctl write getattr lock open add_name search))) ++ (allow utype session_dbusd_tmp_t (sock_file (create getattr setattr open))) ++ (allow dbusd_type dbusd_exec_t (file (entrypoint))) ++ (allow dbusd_type dbusd_exec_t (file (ioctl read getattr lock map execute open))) ++ (allow dbusd_type security_t (lnk_file (read getattr))) ++ (allow dbusd_type sysfs_t (filesystem (getattr))) ++ (allow dbusd_type sysfs_t (dir (getattr open search))) ++ (allow dbusd_type sysfs_t (dir (getattr open search))) ++ (allow dbusd_type security_t (filesystem (getattr))) ++ (allow utype dbusd_type (unix_stream_socket (ioctl read write create getattr setattr lock append bind connect listen accept getopt setopt shutdown connectto))) ++ (allow dbusd_type utype (unix_stream_socket (read write getattr accept getopt))) ++ (allow dbusd_type utype (unix_dgram_socket (sendto))) ++ (allow utype dbusd_type (dbus (acquire_svc send_msg))) ++ (allow dbusd_unconfined dbusd_type (dbus (acquire_svc send_msg))) ++ (allow utype system_dbusd_t (dbus (acquire_svc send_msg))) ++ (allow utype dbusd_type (process (noatsecure siginh rlimitinh))) ++ (allow dbusd_type utype (dbus (send_msg))) ++ (allow utype dbusd_type (dbus (send_msg))) ++ (allow dbusd_type utype (system (start reload))) ++ (allow dbusd_type session_dbusd_tmp_t (service (start stop))) ++ (allow utype session_dbusd_tmp_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype session_dbusd_tmp_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow dbusd_type dbusd_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype dbusd_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype dbusd_type (process (transition))) ++ ;(typetransition utype dbusd_exec_t process dbusd_type) ++ (allow dbusd_type utype (fd (use))) ++ (allow dbusd_type utype (fifo_file (ioctl read write getattr lock append))) ++ (allow dbusd_type utype (process (sigchld))) ++ (allow utype dbusd_type (dir (ioctl read getattr lock open search))) ++ (allow utype dbusd_type (file (ioctl read getattr lock open))) ++ (allow utype dbusd_type (lnk_file (read getattr))) ++ (allow utype dbusd_type (process (getattr))) ++ (allow utype dbusd_type (process (sigchld sigkill sigstop signull signal))) ++ (allow dbusd_type bin_t (dir (getattr open search))) ++ (allow dbusd_type bin_t (lnk_file (read getattr))) ++ (allow dbusd_type bin_t (file (ioctl read getattr map execute open))) ++ (allow dbusd_type utype (process (transition))) ++ (allow dbusd_type usr_t (dir (getattr open search))) ++ (allow dbusd_type usr_t (lnk_file (read getattr))) ++ (allow dbusd_type usr_t (file (ioctl read getattr map execute open))) ++ (allow dbusd_type utype (process (transition))) ++ (typetransition dbusd_type bin_t process utype) ++ (typetransition dbusd_type usr_t process utype) ++ (allow dbusd_type bin_t (dir (getattr open search))) ++ (allow dbusd_type bin_t (dir (ioctl read getattr lock open search))) ++ (allow dbusd_type bin_t (dir (getattr open search))) ++ (allow dbusd_type bin_t (lnk_file (read getattr))) ++ (allow dbusd_type shell_exec_t (file (ioctl read getattr map execute open))) ++ (allow dbusd_type utype (process (transition))) ++ (typetransition dbusd_type shell_exec_t process utype) ++ (allow dbusd_type utype (process (sigkill))) ++ (allow utype dbusd_type (fd (use))) ++ (allow utype dbusd_type (fifo_file (ioctl read write getattr lock append open))) ++ (allow dbusd_type file_type (service (start stop status reload enable disable))) ++ (dontaudit dbusd_type self (capability (net_admin))) ++ (allow utype system_dbusd_t (dbus (send_msg))) ++ (allow utype self (dbus (send_msg))) ++ (allow system_dbusd_t utype (dbus (send_msg))) ++ (allow dbusd_unconfined utype (dbus (send_msg))) ++ (allow utype system_dbusd_var_lib_t (dir (getattr open search))) ++ (allow utype system_dbusd_var_lib_t (file (ioctl read getattr lock open))) ++ (allow utype system_dbusd_var_lib_t (dir (getattr open search))) ++ (allow utype system_dbusd_var_lib_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype urandom_device_t (chr_file (ioctl read getattr lock open))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype system_dbusd_var_run_t (dir (getattr open search))) ++ (allow utype system_dbusd_var_run_t (sock_file (write getattr append open))) ++ (allow utype system_dbusd_t (unix_stream_socket (connectto))) ++ (allow utype dbusd_etc_t (dir (ioctl read getattr lock open search))) ++ (allow utype dbusd_etc_t (file (ioctl read getattr lock open))) ++ (allow utype session_dbusd_tmp_t (dir (getattr open search))) ++ (allow utype session_dbusd_tmp_t (sock_file (write getattr append open))) ++ (allow utype utype (dbus (send_msg))) ++ (booleanif (deny_ptrace) ++ (false ++ (allow utype dbusd_type (process (ptrace))) ++ ) ++ ) ++ (optional confinedom_graphical_login_optional_6 ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require mozilla_exec_t) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset file_type (mozilla_exec_t )) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset non_security_file_type (mozilla_exec_t )) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset exec_type (mozilla_exec_t )) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset entry_type (mozilla_exec_t )) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset non_auth_file_type (mozilla_exec_t )) ++ (allow utype mozilla_exec_t (file (entrypoint))) ++ (allow utype mozilla_exec_t (file (ioctl read getattr lock map execute open))) ++ (allow dbusd_type mozilla_exec_t (file (ioctl read getattr map execute open))) ++ (allow dbusd_type utype (process (transition))) ++ (typetransition dbusd_type mozilla_exec_t process utype) ++ (allow utype dbusd_type (fd (use))) ++ (allow utype dbusd_type (fifo_file (ioctl read write getattr lock append))) ++ (allow utype dbusd_type (process (sigchld))) ++ ) ++ (optional confinedom_graphical_login_optional_7 ++ (typeattributeset cil_gen_require systemd_unit_file_t) ++ (allow dbusd_type systemd_unit_file_t (service (start))) ++ ) ++ (optional confinedom_graphical_login_optional_8 ++ (typeattributeset cil_gen_require unconfined_service_t) ++ (allow utype unconfined_service_t (dbus (send_msg))) ++ (allow unconfined_service_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_9 ++ (typeattributeset cil_gen_require accountsd_t) ++ (allow utype accountsd_t (dbus (send_msg))) ++ (allow accountsd_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_10 ++ (typeattributeset cil_gen_require avahi_t) ++ (allow utype avahi_t (dbus (send_msg))) ++ (allow avahi_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_11 ++ (typeattributeset cil_gen_require bluetooth_t) ++ (allow utype bluetooth_t (dbus (send_msg))) ++ (allow bluetooth_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_12 ++ (typeattributeset cil_gen_require colord_t) ++ (allow utype colord_t (dbus (send_msg))) ++ (allow colord_t utype (dbus (send_msg))) ++ (allow colord_t utype (dir (ioctl read getattr lock open search))) ++ (allow colord_t utype (file (ioctl read getattr lock open))) ++ (allow colord_t utype (lnk_file (read getattr))) ++ (allow colord_t utype (process (getattr))) ++ ) ++ (optional confinedom_graphical_login_optional_13 ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require consolekit_t) ++ (typeattributeset cil_gen_require consolekit_log_t) ++ (typeattributeset cil_gen_require var_log_t) ++ (allow utype consolekit_t (dbus (send_msg))) ++ (allow consolekit_t utype (dbus (send_msg))) ++ (allow utype consolekit_log_t (dir (getattr open search))) ++ (allow utype consolekit_log_t (file (ioctl read getattr lock open))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_log_t (dir (getattr open search))) ++ ) ++ (optional confinedom_graphical_login_optional_14 ++ (typeattributeset cil_gen_require devicekit_t) ++ (typeattributeset cil_gen_require devicekit_power_t) ++ (typeattributeset cil_gen_require devicekit_disk_t) ++ (allow utype devicekit_t (dbus (send_msg))) ++ (allow devicekit_t utype (dbus (send_msg))) ++ (allow utype devicekit_power_t (dbus (send_msg))) ++ (allow devicekit_power_t utype (dbus (send_msg))) ++ (allow utype devicekit_disk_t (dbus (send_msg))) ++ (allow devicekit_disk_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_15 ++ (typeattributeset cil_gen_require evolution_t) ++ (typeattributeset cil_gen_require evolution_alarm_t) ++ (allow utype evolution_t (dbus (send_msg))) ++ (allow evolution_t utype (dbus (send_msg))) ++ (allow utype evolution_alarm_t (dbus (send_msg))) ++ (allow evolution_alarm_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_16 ++ (typeattributeset cil_gen_require firewalld_t) ++ (allow utype firewalld_t (dbus (send_msg))) ++ (allow firewalld_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_17 ++ (typeattributeset cil_gen_require geoclue_t) ++ (allow utype geoclue_t (dbus (send_msg))) ++ (allow geoclue_t utype (dbus (send_msg))) ++ (allow geoclue_t utype (dir (ioctl read getattr lock open search))) ++ (allow geoclue_t utype (file (ioctl read getattr lock open))) ++ (allow geoclue_t utype (lnk_file (read getattr))) ++ (allow geoclue_t utype (process (getattr))) ++ ) ++ (optional confinedom_graphical_login_optional_18 ++ (typeattributeset cil_gen_require gconfdefaultsm_t) ++ (allow utype gconfdefaultsm_t (dbus (send_msg))) ++ (allow gconfdefaultsm_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_19 ++ (typeattributeset cil_gen_require fprintd_t) ++ (allow utype fprintd_t (dbus (send_msg))) ++ (allow fprintd_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_20 ++ (typeattributeset cil_gen_require fwupd_t) ++ (allow utype fwupd_t (dbus (send_msg))) ++ (allow fwupd_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_21 ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require hwloc_dhwd_exec_t) ++ (typeattributeset cil_gen_require hwloc_var_run_t) ++ (allow utype hwloc_dhwd_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype hwloc_var_run_t (dir (getattr open search))) ++ (allow utype hwloc_var_run_t (file (ioctl read getattr lock open))) ++ ) ++ (optional confinedom_graphical_login_optional_22 ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require memcached_t) ++ (typeattributeset cil_gen_require memcached_var_run_t) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype memcached_var_run_t (dir (getattr open search))) ++ (allow utype memcached_var_run_t (sock_file (write getattr append open))) ++ (allow utype memcached_t (unix_stream_socket (connectto))) ++ ) ++ (optional confinedom_graphical_login_optional_23 ++ (typeattributeset cil_gen_require modemmanager_t) ++ (allow utype modemmanager_t (dbus (send_msg))) ++ (allow modemmanager_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_24 ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require NetworkManager_t) ++ (typeattributeset cil_gen_require NetworkManager_var_lib_t) ++ (allow utype NetworkManager_t (dbus (send_msg))) ++ (allow NetworkManager_t utype (dbus (send_msg))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype NetworkManager_var_lib_t (dir (getattr open search))) ++ (allow utype NetworkManager_var_lib_t (dir (ioctl read getattr lock open search))) ++ (allow utype NetworkManager_var_lib_t (dir (getattr open search))) ++ (allow utype NetworkManager_var_lib_t (file (ioctl read getattr lock open))) ++ (allow utype NetworkManager_var_lib_t (file (map))) ++ ) ++ (optional confinedom_graphical_login_optional_25 ++ (typeattributeset cil_gen_require policykit_t) ++ (allow policykit_t utype (dir (ioctl read getattr lock open search))) ++ (allow policykit_t utype (file (ioctl read getattr lock open))) ++ (allow policykit_t utype (lnk_file (read getattr))) ++ (allow policykit_t utype (process (getattr))) ++ (allow utype policykit_t (dbus (send_msg))) ++ (allow policykit_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_26 ++ (typeattributeset cil_gen_require rpm_t) ++ (allow utype rpm_t (dbus (send_msg))) ++ (allow rpm_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_graphical_login_optional_27 ++ (typeattributeset cil_gen_require vpnc_t) ++ (allow utype vpnc_t (dbus (send_msg))) ++ (allow vpnc_t utype (dbus (send_msg))) ++ ) ++ ) ++ (optional confinedom_graphical_login_optional_28 ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require rpm_var_lib_t) ++ (typeattributeset cil_gen_require rpm_var_cache_t) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype rpm_var_lib_t (dir (ioctl read getattr lock open search))) ++ (allow utype rpm_var_lib_t (dir (getattr open search))) ++ (allow utype rpm_var_lib_t (file (ioctl read getattr lock open))) ++ (allow utype rpm_var_lib_t (dir (getattr open search))) ++ (allow utype rpm_var_lib_t (lnk_file (read getattr))) ++ (allow utype rpm_var_lib_t (file (map))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype rpm_var_cache_t (dir (ioctl read getattr lock open search))) ++ (allow utype rpm_var_cache_t (dir (getattr open search))) ++ (allow utype rpm_var_cache_t (file (ioctl read getattr lock open))) ++ (allow utype rpm_var_cache_t (dir (getattr open search))) ++ (allow utype rpm_var_cache_t (lnk_file (read getattr))) ++ ) ++ (optional confinedom_graphical_login_optional_29 ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require systemd_logind_t) ++ (typeattributeset cil_gen_require systemd_timedated_t) ++ (typeattributeset cil_gen_require systemd_hostnamed_t) ++ (typeattributeset cil_gen_require systemd_localed_t) ++ (typeattributeset cil_gen_require systemd_unit_file_type) ++ (typeattributeset cil_gen_require init_script_file_type) ++ (typeattributeset cil_gen_require systemd_logind_var_run_t) ++ (typeattributeset cil_gen_require systemd_logind_sessions_t) ++ (typeattributeset cil_gen_require init_var_run_t) ++ (typeattributeset cil_gen_require systemd_machined_var_run_t) ++ (typeattributeset cil_gen_require systemd_logind_inhibit_var_run_t) ++ (allow utype systemd_logind_t (dbus (send_msg))) ++ (allow systemd_logind_t utype (dbus (send_msg))) ++ (allow systemd_logind_t utype (dir (ioctl read getattr lock open search))) ++ (allow systemd_logind_t utype (file (ioctl read getattr lock open))) ++ (allow systemd_logind_t utype (lnk_file (read getattr))) ++ (allow systemd_logind_t utype (process (getattr))) ++ (allow systemd_logind_t utype (process (signal))) ++ (allow utype systemd_logind_t (fd (use))) ++ (allow utype systemd_timedated_t (dbus (send_msg))) ++ (allow systemd_timedated_t utype (dbus (send_msg))) ++ (allow systemd_timedated_t utype (dir (ioctl read getattr lock open search))) ++ (allow systemd_timedated_t utype (file (ioctl read getattr lock open))) ++ (allow systemd_timedated_t utype (lnk_file (read getattr))) ++ (allow systemd_timedated_t utype (process (getattr))) ++ (allow utype systemd_hostnamed_t (dbus (send_msg))) ++ (allow systemd_hostnamed_t utype (dbus (send_msg))) ++ (allow systemd_hostnamed_t utype (dir (ioctl read getattr lock open search))) ++ (allow systemd_hostnamed_t utype (file (ioctl read getattr lock open))) ++ (allow systemd_hostnamed_t utype (lnk_file (read getattr))) ++ (allow systemd_hostnamed_t utype (process (getattr))) ++ (allow utype systemd_localed_t (dbus (send_msg))) ++ (allow systemd_localed_t utype (dbus (send_msg))) ++ (allow systemd_localed_t utype (dir (ioctl read getattr lock open search))) ++ (allow systemd_localed_t utype (file (ioctl read getattr lock open))) ++ (allow systemd_localed_t utype (lnk_file (read getattr))) ++ (allow systemd_localed_t utype (process (getattr))) ++ (allow utype systemd_unit_file_type (service (start stop status reload enable disable))) ++ (allow utype init_script_file_type (service (start stop status reload enable disable))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (getattr watch))) ++ (allow utype init_var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_sessions_t (dir (getattr watch))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype systemd_machined_var_run_t (dir (getattr watch))) ++ (allow utype init_var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_sessions_t (dir (ioctl read getattr lock open search))) ++ (allow utype systemd_logind_sessions_t (dir (getattr open search))) ++ (allow utype systemd_logind_sessions_t (file (ioctl read getattr lock open))) ++ (allow utype systemd_logind_inhibit_var_run_t (fifo_file (write))) ++ ) ++ (optional confinedom_graphical_login_optional_30 ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require cupsd_t) ++ (typeattributeset cil_gen_require cupsd_var_run_t) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype cupsd_var_run_t (dir (getattr open search))) ++ (allow utype cupsd_var_run_t (sock_file (write getattr append open))) ++ (allow utype cupsd_t (unix_stream_socket (connectto))) ++ (allow utype cupsd_var_run_t (sock_file (read getattr open))) ++ ) ++ (optional confinedom_graphical_login_optional_31 ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require mount_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require fusermount_exec_t) ++ (typeattributeset cil_gen_require fsadm_t) ++ (typeattributeset cil_gen_require fsadm_exec_t) ++ (typeattributeset cil_gen_require mount_var_run_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole mount_t) ++ (roletype urole fsadm_t) ++ (allow utype fusermount_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype mount_t (process (transition))) ++ (typetransition utype fusermount_exec_t process mount_t) ++ (allow mount_t utype (fd (use))) ++ (allow mount_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow mount_t utype (process (sigchld))) ++ (allow mount_t utype (dir (ioctl read getattr lock open search))) ++ (allow mount_t utype (file (ioctl read getattr lock open))) ++ (allow mount_t utype (lnk_file (read getattr))) ++ (allow mount_t utype (process (getattr))) ++ (allow mount_t utype (unix_stream_socket (read write))) ++ (allow utype mount_t (fd (use))) ++ (allow mount_t bin_t (dir (getattr open search))) ++ (allow mount_t bin_t (lnk_file (read getattr))) ++ (allow mount_t bin_t (dir (getattr open search))) ++ (allow mount_t bin_t (dir (getattr open search))) ++ (allow mount_t fsadm_exec_t (file (ioctl read getattr map execute open))) ++ (allow mount_t fsadm_t (process (transition))) ++ (typetransition mount_t fsadm_exec_t process fsadm_t) ++ (allow fsadm_t mount_t (fd (use))) ++ (allow fsadm_t mount_t (fifo_file (ioctl read write getattr lock append))) ++ (allow fsadm_t mount_t (process (sigchld))) ++ (allow utype mount_var_run_t (dir (getattr open search))) ++ (allow utype mount_var_run_t (file (ioctl read getattr lock open))) ++ (allow utype mount_var_run_t (dir (getattr open search))) ++ (allow utype mount_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ ) ++ (optional confinedom_graphical_login_optional_32 ++ (typeattributeset cil_gen_require home_root_t) ++ (typeattributeset cil_gen_require tmp_t) ++ (typeattributeset cil_gen_require user_tmp_t) ++ (typeattributeset cil_gen_require user_home_dir_t) ++ (typeattributeset cil_gen_require tmpfs_t) ++ (typeattributeset cil_gen_require pulseaudio_tmpfsfile) ++ (typeattributeset cil_gen_require pulseaudio_t) ++ (typeattributeset cil_gen_require pulseaudio_exec_t) ++ (typeattributeset cil_gen_require pulseaudio_tmpfs_t) ++ (typeattributeset cil_gen_require user_tmp_type) ++ (typeattributeset cil_gen_require pulseaudio_home_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole user_tmp_t) ++ (roletype urole pulseaudio_t) ++ (allow utype pulseaudio_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype pulseaudio_t (process (transition))) ++ (typetransition utype pulseaudio_exec_t process pulseaudio_t) ++ (allow pulseaudio_t utype (fd (use))) ++ (allow pulseaudio_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow pulseaudio_t utype (process (sigchld))) ++ (allow utype pulseaudio_t (dir (ioctl read getattr lock open search))) ++ (allow utype pulseaudio_t (file (ioctl read getattr lock open))) ++ (allow utype pulseaudio_t (lnk_file (read getattr))) ++ (allow utype pulseaudio_t (process (getattr))) ++ (allow pulseaudio_t utype (process (signull signal))) ++ (allow utype pulseaudio_t (process (sigkill signull signal))) ++ (allow utype pulseaudio_t (process2 (nnp_transition))) ++ (allow pulseaudio_t utype (dir (ioctl read getattr lock open search))) ++ (allow pulseaudio_t utype (file (ioctl read getattr lock open))) ++ (allow pulseaudio_t utype (lnk_file (read getattr))) ++ (allow pulseaudio_t utype (process (getattr))) ++ (allow pulseaudio_t utype (unix_stream_socket (connectto))) ++ (allow utype pulseaudio_t (unix_stream_socket (connectto))) ++ (allow utype pulseaudio_tmpfsfile (dir (ioctl read write create getattr setattr lock relabelfrom relabelto unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype pulseaudio_tmpfs_t (dir (ioctl read write create getattr setattr lock relabelfrom relabelto unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype pulseaudio_tmpfsfile (file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open watch watch_reads))) ++ (allow utype pulseaudio_tmpfs_t (file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open watch watch_reads))) ++ (typemember pulseaudio_t tmp_t dir user_tmp_t) ++ (allow pulseaudio_t user_tmp_type (dir (mounton))) ++ (allow pulseaudio_t user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow pulseaudio_t user_tmp_type (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow pulseaudio_t user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow pulseaudio_t user_tmp_type (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow pulseaudio_t user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow pulseaudio_t user_tmp_type (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow pulseaudio_t user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow pulseaudio_t user_tmp_type (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow pulseaudio_t user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow pulseaudio_t user_tmp_type (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow pulseaudio_t tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (typetransition pulseaudio_t tmp_t fifo_file user_tmp_t) ++ (typetransition pulseaudio_t tmp_t sock_file user_tmp_t) ++ (typetransition pulseaudio_t tmp_t lnk_file user_tmp_t) ++ (typetransition pulseaudio_t tmp_t dir user_tmp_t) ++ (typetransition pulseaudio_t tmp_t file user_tmp_t) ++ (allow user_tmp_t tmpfs_t (filesystem (associate))) ++ (allow pulseaudio_t tmpfs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (typetransition pulseaudio_t tmpfs_t fifo_file user_tmp_t) ++ (typetransition pulseaudio_t tmpfs_t sock_file user_tmp_t) ++ (typetransition pulseaudio_t tmpfs_t lnk_file user_tmp_t) ++ (typetransition pulseaudio_t tmpfs_t dir user_tmp_t) ++ (typetransition pulseaudio_t tmpfs_t file user_tmp_t) ++ (allow pulseaudio_t user_tmp_type (dir (getattr open search))) ++ (allow pulseaudio_t user_tmp_type (dir (getattr relabelfrom relabelto))) ++ (allow pulseaudio_t user_tmp_type (dir (getattr open search))) ++ (allow pulseaudio_t user_tmp_type (file (getattr relabelfrom relabelto))) ++ (allow pulseaudio_t user_tmp_type (dir (getattr open search))) ++ (allow pulseaudio_t user_tmp_type (lnk_file (getattr relabelfrom relabelto))) ++ (allow pulseaudio_t user_tmp_type (dir (getattr open search))) ++ (allow pulseaudio_t user_tmp_type (sock_file (getattr relabelfrom relabelto))) ++ (allow pulseaudio_t user_tmp_type (dir (getattr open search))) ++ (allow pulseaudio_t user_tmp_type (fifo_file (getattr relabelfrom relabelto))) ++ (allow pulseaudio_t user_tmp_type (file (map))) ++ (allow utype pulseaudio_t (dbus (send_msg))) ++ (allow pulseaudio_t utype (dbus (acquire_svc send_msg))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (typetransition utype user_home_dir_t file ".esd_auth" pulseaudio_home_t) ++ (typetransition utype user_home_dir_t file ".pulse-cookie" pulseaudio_home_t) ++ (typetransition utype user_home_dir_t dir ".pulse" pulseaudio_home_t) ++ (optional confinedom_graphical_login_optional_33 ++ (typeattributeset cil_gen_require home_root_t) ++ (typeattributeset cil_gen_require user_home_dir_t) ++ (typeattributeset cil_gen_require config_home_t) ++ (allow utype config_home_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_dir_t (dir (getattr open search))) ++ (allow utype user_home_dir_t (lnk_file (read getattr))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (typetransition utype config_home_t dir "pulse" pulseaudio_home_t) ++ ) ++ ) ++ (optional confinedom_graphical_login_optional_34 ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require var_log_t) ++ (typeattributeset cil_gen_require vdagent_log_t) ++ (typeattributeset cil_gen_require vdagent_var_run_t) ++ (typeattributeset cil_gen_require vdagent_t) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_log_t (dir (getattr open search))) ++ (allow utype vdagent_log_t (file (getattr))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype vdagent_var_run_t (dir (getattr open search))) ++ (allow utype vdagent_var_run_t (sock_file (write getattr append open))) ++ (allow utype vdagent_t (unix_stream_socket (connectto))) ++ ) ++ (optional confinedom_graphical_login_optional_35 ++ (typeattributeset cil_gen_require proc_t) ++ (typeattributeset cil_gen_require rtkit_daemon_t) ++ (allow rtkit_daemon_t utype (process (getsched setsched))) ++ (allow utype proc_t (dir (getattr open search))) ++ (allow utype proc_t (dir (getattr open search))) ++ (allow rtkit_daemon_t utype (dir (ioctl read getattr lock open search))) ++ (allow rtkit_daemon_t utype (file (ioctl read getattr lock open))) ++ (allow rtkit_daemon_t utype (lnk_file (read getattr))) ++ (allow rtkit_daemon_t utype (process (getattr))) ++ (optional confinedom_graphical_login_optional_36 ++ (typeattributeset cil_gen_require rtkit_daemon_t) ++ (allow utype rtkit_daemon_t (dbus (send_msg))) ++ (allow rtkit_daemon_t utype (dbus (send_msg))) ++ ) ++ ) ++ ) ++) ++ ++(macro confinedom_mozilla_usage_macro ((type utype) (role urole)) ++ (optional confinedom_mozilla_usage_optional ++ (roleattributeset cil_gen_require mozilla_roles) ++ (roleattributeset cil_gen_require urole) ++ (typeattributeset cil_gen_require mozilla_t) ++ (typeattributeset cil_gen_require mozilla_exec_t) ++ (typeattributeset cil_gen_require mozilla_home_t) ++ (typeattributeset cil_gen_require mozilla_tmpfs_t) ++ (typeattributeset cil_gen_require utype) ++ (optional confinedom_mozilla_usage_optional_3 ++ (roleattributeset cil_gen_require mozilla_plugin_roles) ++ (roleattributeset cil_gen_require mozilla_plugin_config_roles) ++ (typeattributeset cil_gen_require mozilla_t) ++ (typeattributeset cil_gen_require mozilla_home_t) ++ (typeattributeset cil_gen_require mozilla_plugin_t) ++ (typeattributeset cil_gen_require mozilla_plugin_exec_t) ++ (typeattributeset cil_gen_require mozilla_plugin_config_t) ++ (typeattributeset cil_gen_require mozilla_plugin_config_exec_t) ++ (typeattributeset cil_gen_require mozilla_plugin_rw_t) ++ (typeattributeset cil_gen_require lib_t) ++ (typeattributeset cil_gen_require user_home_dir_t) ++ (typeattributeset cil_gen_require home_root_t) ++ (roleattributeset cil_gen_require mozilla_plugin_config_roles) ++ (roleattributeset mozilla_plugin_config_roles (urole )) ++ (roleattributeset cil_gen_require mozilla_plugin_roles) ++ (roleattributeset mozilla_plugin_roles (urole )) ++ (allow utype mozilla_t (process (noatsecure siginh rlimitinh))) ++ (allow utype mozilla_t (dir (ioctl read getattr lock open search))) ++ (allow utype mozilla_t (file (ioctl read getattr lock open))) ++ (allow utype mozilla_t (lnk_file (read getattr))) ++ (allow utype mozilla_t (process (getattr))) ++ (allow utype mozilla_t (process (sigchld sigkill sigstop signull signal))) ++ (allow utype mozilla_t (fd (use))) ++ (allow utype mozilla_t (shm (getattr associate))) ++ (allow utype mozilla_t (shm (unix_read unix_write))) ++ (allow utype mozilla_t (unix_stream_socket (connectto))) ++ (allow utype mozilla_plugin_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype mozilla_plugin_t (process (transition))) ++ (typetransition utype mozilla_plugin_exec_t process mozilla_plugin_t) ++ (allow mozilla_plugin_t utype (fd (use))) ++ (allow mozilla_plugin_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow mozilla_plugin_t utype (process (sigchld))) ++ (allow utype mozilla_plugin_config_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype mozilla_plugin_config_t (process (transition))) ++ (typetransition utype mozilla_plugin_config_exec_t process mozilla_plugin_config_t) ++ (allow mozilla_plugin_config_t utype (fd (use))) ++ (allow mozilla_plugin_config_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow mozilla_plugin_config_t utype (process (sigchld))) ++ (allow mozilla_plugin_t utype (process (signull))) ++ (dontaudit mozilla_plugin_config_t utype (file (ioctl read getattr lock))) ++ (dontaudit mozilla_plugin_t utype (process (signal))) ++ (allow utype mozilla_plugin_t (unix_stream_socket (ioctl read write getattr setattr lock append bind connect getopt setopt shutdown connectto))) ++ (allow utype mozilla_plugin_t (fd (use))) ++ (allow mozilla_plugin_t utype (unix_stream_socket (ioctl read write getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow mozilla_plugin_t utype (unix_dgram_socket (ioctl read write getattr setattr lock append bind connect getopt setopt shutdown sendto))) ++ (allow mozilla_plugin_t utype (shm (destroy getattr read write associate unix_read unix_write lock))) ++ (allow mozilla_plugin_t utype (sem (create destroy getattr setattr read write associate unix_read unix_write))) ++ (allow utype mozilla_plugin_t (sem (getattr read write associate unix_read unix_write))) ++ (allow utype mozilla_plugin_t (shm (getattr read write associate unix_read unix_write lock))) ++ (allow utype mozilla_plugin_t (fifo_file (ioctl read write getattr lock append open))) ++ (allow utype mozilla_plugin_t (dir (ioctl read getattr lock open search))) ++ (allow utype mozilla_plugin_t (file (ioctl read getattr lock open))) ++ (allow utype mozilla_plugin_t (lnk_file (read getattr))) ++ (allow utype mozilla_plugin_t (process (getattr))) ++ (allow mozilla_plugin_t utype (dir (ioctl read getattr lock open search))) ++ (allow mozilla_plugin_t utype (file (ioctl read getattr lock open))) ++ (allow mozilla_plugin_t utype (lnk_file (read getattr))) ++ (allow mozilla_plugin_t utype (process (getattr))) ++ (allow utype mozilla_plugin_t (process (sigchld sigkill sigstop signull signal noatsecure))) ++ (allow utype mozilla_plugin_rw_t (dir (getattr open search))) ++ (allow utype mozilla_plugin_rw_t (dir (ioctl read getattr lock open search))) ++ (allow utype mozilla_plugin_rw_t (dir (getattr open search))) ++ (allow utype mozilla_plugin_rw_t (file (ioctl read getattr lock open))) ++ (allow utype mozilla_plugin_rw_t (dir (getattr open search))) ++ (allow utype mozilla_plugin_rw_t (lnk_file (read getattr))) ++ (allow utype mozilla_plugin_rw_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype mozilla_plugin_t (dbus (send_msg))) ++ (allow mozilla_plugin_t utype (dbus (send_msg))) ++ (allow mozilla_plugin_t utype (process (signull))) ++ (allow utype mozilla_t (dbus (send_msg))) ++ (allow mozilla_t utype (dbus (send_msg))) ++ (allow utype mozilla_plugin_rw_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (typetransition utype user_home_dir_t dir ".webex" mozilla_home_t) ++ (typetransition utype user_home_dir_t file "mozilla.pdf" mozilla_home_t) ++ (typetransition utype user_home_dir_t file ".gnashpluginrc" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".IBMERS" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".lyx" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".juniper_networks" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir "zimbrauserdata" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".ICAClient" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".spicec" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".quakelive" mozilla_home_t) ++ (typetransition utype user_home_dir_t file "abc" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".icedtea" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".icedteaplugin" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".gcjwebplugin" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".grl-podcasts" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".gnash" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".macromedia" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".adobe" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".phoenix" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".netscape" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".thunderbird" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".mozilla" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".java" mozilla_home_t) ++ (typetransition utype user_home_dir_t dir ".galeon" mozilla_home_t) ++ (typetransition utype mozilla_plugin_rw_t file "nswrapper_32_64.nppdf.so" lib_t) ++ (booleanif (deny_ptrace) ++ (false ++ (allow utype mozilla_plugin_t (process (ptrace))) ++ ) ++ ) ++ (optional confinedom_mozilla_usage_optional_4 ++ (roleattributeset cil_gen_require lpr_roles) ++ (typeattributeset cil_gen_require lpr_t) ++ (typeattributeset cil_gen_require lpr_exec_t) ++ (roleattributeset cil_gen_require lpr_roles) ++ (roleattributeset lpr_roles (urole )) ++ (allow mozilla_plugin_t lpr_exec_t (file (ioctl read getattr map execute open))) ++ (allow mozilla_plugin_t lpr_t (process (transition))) ++ (typetransition mozilla_plugin_t lpr_exec_t process lpr_t) ++ (allow lpr_t mozilla_plugin_t (fd (use))) ++ (allow lpr_t mozilla_plugin_t (fifo_file (ioctl read write getattr lock append))) ++ (allow lpr_t mozilla_plugin_t (process (sigchld))) ++ ) ++ (optional confinedom_mozilla_usage_optional_5 ++ (typeattributeset cil_gen_require user_home_dir_t) ++ (typeattributeset cil_gen_require home_root_t) ++ (typeattributeset cil_gen_require cache_home_t) ++ (allow utype cache_home_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_dir_t (dir (getattr open search))) ++ (allow utype user_home_dir_t (lnk_file (read getattr))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype cache_home_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_dir_t (dir (getattr open search))) ++ (allow utype user_home_dir_t (lnk_file (read getattr))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (typetransition utype cache_home_t dir "icedtea-web" mozilla_home_t) ++ (typetransition utype cache_home_t dir "mozilla" mozilla_home_t) ++ ) ++ ) ++ ) ++) ++ ++(macro confinedom_networking_macro ((type utype) (role urole)) ++ (optional confinedom_networking_optional_2 ++ (roleattributeset cil_gen_require urole) ++ (typeattributeset cil_gen_require utype) ++ (typeattributeset cil_gen_require ping_t) ++ (typeattributeset cil_gen_require ping_exec_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require traceroute_t) ++ (typeattributeset cil_gen_require traceroute_exec_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole ping_t) ++ (roletype urole traceroute_t) ++ (booleanif (selinuxuser_ping) ++ (true ++ (allow utype ping_t (process (sigkill signal))) ++ (allow ping_t utype (process (sigchld))) ++ (allow ping_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow ping_t utype (fd (use))) ++ (typetransition utype ping_exec_t process ping_t) ++ (allow utype ping_t (process (transition))) ++ (allow utype ping_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype traceroute_t (process (sigkill signal))) ++ (allow traceroute_t utype (process (sigchld))) ++ (allow traceroute_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow traceroute_t utype (fd (use))) ++ (typetransition utype traceroute_exec_t process traceroute_t) ++ (allow utype traceroute_t (process (transition))) ++ (allow utype traceroute_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ ) ++ ) ++ ) ++) ++ ++(macro confinedom_security_advanced_macro ((type utype) (role urole) (type sudo_type) (type userhelper_type)) ++ (optional confinedom_security_advanced_optional_2 ++ (roleattributeset cil_gen_require urole) ++ (typeattributeset cil_gen_require utype) ++ (typeattributeset cil_gen_require sudo_type) ++ (typeattributeset cil_gen_require auditd_log_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require auditd_etc_t) ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require security_t) ++ (typeattributeset cil_gen_require can_setenforce) ++ (typeattributeset cil_gen_require sysfs_t) ++ (typeattributeset cil_gen_require secure_mode_policyload_t) ++ (typeattributeset cil_gen_require boolean_type) ++ (typeattributeset cil_gen_require can_setbool) ++ (typeattributeset cil_gen_require semanage_t) ++ (typeattributeset cil_gen_require selinux_config_t) ++ (typeattributeset cil_gen_require semanage_store_t) ++ (typeattributeset cil_gen_require selinux_login_config_t) ++ (typeattributeset cil_gen_require semanage_exec_t) ++ (typeattributeset cil_gen_require usr_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require setfiles_t) ++ (typeattributeset cil_gen_require setfiles_exec_t) ++ (typeattributeset cil_gen_require load_policy_t) ++ (typeattributeset cil_gen_require load_policy_exec_t) ++ (typeattributeset cil_gen_require newrole_t) ++ (typeattributeset cil_gen_require newrole_exec_t) ++ (typeattributeset cil_gen_require updpwd_t) ++ (typeattributeset cil_gen_require updpwd_exec_t) ++ (typeattributeset cil_gen_require shadow_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole semanage_t) ++ (roletype urole setfiles_t) ++ (roletype urole load_policy_t) ++ (roletype urole newrole_t) ++ (roletype urole updpwd_t) ++ (typeattributeset cil_gen_require can_setbool) ++ (typeattributeset can_setbool (utype )) ++ (typeattributeset cil_gen_require can_setenforce) ++ (typeattributeset can_setenforce (utype )) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype auditd_log_t (dir (getattr open search))) ++ (allow utype auditd_log_t (file (ioctl read getattr lock open))) ++ (allow utype auditd_log_t (dir (getattr open search))) ++ (allow utype auditd_log_t (lnk_file (read getattr))) ++ (allow utype auditd_log_t (dir (ioctl read getattr lock open search))) ++ (allow utype etc_t (dir (getattr open search))) ++ (allow utype auditd_etc_t (dir (getattr open search))) ++ (allow utype auditd_etc_t (file (ioctl read getattr lock open))) ++ (allow utype auditd_etc_t (dir (ioctl read getattr lock open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype security_t (dir (ioctl read getattr lock open search))) ++ (allow utype security_t (file (ioctl read write getattr lock append open))) ++ (allow utype sysfs_t (filesystem (getattr))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype security_t (lnk_file (read getattr))) ++ (allow utype security_t (dir (ioctl read getattr lock open search))) ++ (allow utype boolean_type (dir (ioctl read getattr lock open search))) ++ (allow utype boolean_type (file (ioctl read write getattr lock append open))) ++ (allow semanage_t utype (dir (ioctl read getattr lock open search))) ++ (allow semanage_t utype (file (ioctl read getattr lock open))) ++ (allow semanage_t utype (lnk_file (read getattr))) ++ (allow semanage_t utype (process (getattr))) ++ (allow utype semanage_t (dbus (send_msg))) ++ (allow semanage_t utype (dbus (send_msg))) ++ (allow utype etc_t (dir (getattr open search))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype selinux_config_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype semanage_store_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype semanage_store_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype semanage_store_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype semanage_store_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype semanage_store_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype semanage_store_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype semanage_store_t (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow utype selinux_config_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype selinux_config_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype selinux_config_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype selinux_config_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype etc_t (dir (getattr open search))) ++ (allow utype selinux_config_t (dir (getattr open search))) ++ (allow utype selinux_login_config_t (dir (ioctl read getattr lock open search))) ++ (allow utype selinux_login_config_t (dir (getattr open search))) ++ (allow utype selinux_login_config_t (file (ioctl read getattr lock open))) ++ (allow utype selinux_login_config_t (dir (getattr open search))) ++ (allow utype selinux_login_config_t (lnk_file (read getattr))) ++ (allow sudo_type usr_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (lnk_file (read getattr))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type semanage_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type semanage_t (process (transition))) ++ (typetransition sudo_type semanage_exec_t process semanage_t) ++ (allow semanage_t sudo_type (fd (use))) ++ (allow semanage_t sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow semanage_t sudo_type (process (sigchld))) ++ (allow semanage_t usr_t (dir (getattr open search))) ++ (allow semanage_t bin_t (dir (getattr open search))) ++ (allow semanage_t bin_t (lnk_file (read getattr))) ++ (allow semanage_t bin_t (dir (getattr open search))) ++ (allow semanage_t bin_t (dir (getattr open search))) ++ (allow semanage_t setfiles_exec_t (file (ioctl read getattr map execute open))) ++ (allow semanage_t setfiles_t (process (transition))) ++ (typetransition semanage_t setfiles_exec_t process setfiles_t) ++ (allow setfiles_t semanage_t (fd (use))) ++ (allow setfiles_t semanage_t (fifo_file (ioctl read write getattr lock append))) ++ (allow setfiles_t semanage_t (process (sigchld))) ++ (allow semanage_t bin_t (dir (getattr open search))) ++ (allow semanage_t bin_t (lnk_file (read getattr))) ++ (allow semanage_t bin_t (dir (getattr open search))) ++ (allow semanage_t bin_t (dir (getattr open search))) ++ (allow semanage_t load_policy_exec_t (file (ioctl read getattr map execute open))) ++ (allow semanage_t load_policy_t (process (transition))) ++ (typetransition semanage_t load_policy_exec_t process load_policy_t) ++ (allow load_policy_t semanage_t (fd (use))) ++ (allow load_policy_t semanage_t (fifo_file (ioctl read write getattr lock append))) ++ (allow load_policy_t semanage_t (process (sigchld))) ++ (allow utype usr_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype newrole_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype newrole_t (process (transition))) ++ (typetransition utype newrole_exec_t process newrole_t) ++ (allow newrole_t utype (fd (use))) ++ (allow newrole_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow newrole_t utype (process (sigchld))) ++ (allow newrole_t updpwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow newrole_t updpwd_t (process (transition))) ++ (typetransition newrole_t updpwd_exec_t process updpwd_t) ++ (allow updpwd_t newrole_t (fd (use))) ++ (allow updpwd_t newrole_t (fifo_file (ioctl read write getattr lock append))) ++ (allow updpwd_t newrole_t (process (sigchld))) ++ (dontaudit newrole_t shadow_t (file (ioctl read getattr lock open))) ++ (allow sudo_type usr_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (lnk_file (read getattr))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type setfiles_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type setfiles_t (process (transition))) ++ (typetransition sudo_type setfiles_exec_t process setfiles_t) ++ (allow setfiles_t sudo_type (fd (use))) ++ (allow setfiles_t sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow setfiles_t sudo_type (process (sigchld))) ++ (typetransition utype selinux_config_t dir "tmp" semanage_store_t) ++ (typetransition utype selinux_config_t dir "previous" semanage_store_t) ++ (typetransition utype selinux_config_t dir "active" semanage_store_t) ++ (typetransition utype selinux_config_t dir "modules" semanage_store_t) ++ (optional confinedom_security_advanced_optional_3 ++ (typeattributeset cil_gen_require usr_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require setfiles_t) ++ (typeattributeset cil_gen_require setfiles_exec_t) ++ (typeattributeset cil_gen_require namespace_init_t) ++ (typeattributeset cil_gen_require namespace_init_exec_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole setfiles_t) ++ (roletype urole namespace_init_t) ++ (allow newrole_t namespace_init_exec_t (file (ioctl read getattr map execute open))) ++ (allow newrole_t namespace_init_t (process (transition))) ++ (typetransition newrole_t namespace_init_exec_t process namespace_init_t) ++ (allow namespace_init_t newrole_t (fd (use))) ++ (allow namespace_init_t newrole_t (fifo_file (ioctl read write getattr lock append))) ++ (allow namespace_init_t newrole_t (process (sigchld))) ++ (allow namespace_init_t usr_t (dir (getattr open search))) ++ (allow namespace_init_t bin_t (dir (getattr open search))) ++ (allow namespace_init_t bin_t (lnk_file (read getattr))) ++ (allow namespace_init_t bin_t (dir (getattr open search))) ++ (allow namespace_init_t bin_t (dir (getattr open search))) ++ (allow namespace_init_t setfiles_exec_t (file (ioctl read getattr map execute open))) ++ (allow namespace_init_t setfiles_t (process (transition))) ++ (typetransition namespace_init_t setfiles_exec_t process setfiles_t) ++ (allow setfiles_t namespace_init_t (fd (use))) ++ (allow setfiles_t namespace_init_t (fifo_file (ioctl read write getattr lock append))) ++ (allow setfiles_t namespace_init_t (process (sigchld))) ++ ) ++ (optional confinedom_security_advanced_optional_4 ++ (roletype object_r userhelper_type) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require security_t) ++ (typeattributeset cil_gen_require sysfs_t) ++ (typeattributeset cil_gen_require selinux_config_t) ++ (typeattributeset cil_gen_require usr_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require updpwd_t) ++ (typeattributeset cil_gen_require updpwd_exec_t) ++ (typeattributeset cil_gen_require shadow_t) ++ (typeattributeset cil_gen_require userhelper_type) ++ (typeattributeset cil_gen_require userhelper_exec_t) ++ (typeattributeset cil_gen_require userhelper_conf_t) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset cil_gen_require can_change_process_role) ++ (typeattributeset cil_gen_require can_change_object_identity) ++ (typeattributeset cil_gen_require privfd) ++ (typeattributeset cil_gen_require can_change_process_identity) ++ (typeattributeset cil_gen_require sysctl_type) ++ (typeattributeset cil_gen_require proc_t) ++ (typeattributeset cil_gen_require proc_net_t) ++ (typeattributeset cil_gen_require debugfs_t) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset cil_gen_require shell_exec_t) ++ (typeattributeset cil_gen_require device_t) ++ (typeattributeset cil_gen_require urandom_device_t) ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require etc_runtime_t) ++ (typeattributeset cil_gen_require home_root_t) ++ (typeattributeset cil_gen_require autofs_t) ++ (typeattributeset cil_gen_require nfs_t) ++ (typeattributeset cil_gen_require devpts_t) ++ (typeattributeset cil_gen_require ttynode) ++ (typeattributeset cil_gen_require ptynode) ++ (typeattributeset cil_gen_require chkpwd_t) ++ (typeattributeset cil_gen_require chkpwd_exec_t) ++ (typeattributeset cil_gen_require auth_cache_t) ++ (typeattributeset cil_gen_require random_device_t) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset cil_gen_require faillog_t) ++ (typeattributeset cil_gen_require var_log_t) ++ (typeattributeset cil_gen_require cert_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require pam_var_run_t) ++ (typeattributeset cil_gen_require var_auth_t) ++ (typeattributeset cil_gen_require pam_var_console_t) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset cil_gen_require init_t) ++ (typeattributeset cil_gen_require initrc_var_run_t) ++ (typeattributeset cil_gen_require default_context_t) ++ (typeattributeset cil_gen_require unpriv_userdomain) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole userhelper_type) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset netlabel_peer_type (userhelper_type )) ++ (typeattributeset cil_gen_require can_change_process_identity) ++ (typeattributeset can_change_process_identity (userhelper_type )) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset corenet_unlabeled_type (userhelper_type )) ++ (typeattributeset cil_gen_require privfd) ++ (typeattributeset privfd (userhelper_type )) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset syslog_client_type (userhelper_type )) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset file_type (userhelper_exec_t )) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset non_security_file_type (userhelper_exec_t )) ++ (typeattributeset cil_gen_require can_change_object_identity) ++ (typeattributeset can_change_object_identity (userhelper_type )) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset exec_type (userhelper_exec_t )) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset application_domain_type (userhelper_type )) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset ubac_constrained_type (userhelper_type )) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset kernel_system_state_reader (userhelper_type )) ++ (typeattributeset cil_gen_require can_change_process_role) ++ (typeattributeset can_change_process_role (userhelper_type )) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset application_exec_type (userhelper_exec_t )) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset nsswitch_domain (userhelper_type )) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset entry_type (userhelper_exec_t )) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset non_auth_file_type (userhelper_exec_t )) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset domain (userhelper_type )) ++ (typeattributeset cil_gen_require userhelper_type) ++ (allow userhelper_type userhelper_exec_t (file (entrypoint))) ++ (allow userhelper_type userhelper_exec_t (file (ioctl read getattr lock map execute open))) ++ (allow userhelper_type self (capability (chown dac_read_search setgid setuid net_bind_service sys_tty_config))) ++ (allow userhelper_type self (process (fork transition sigchld sigkill sigstop signull signal getsched setsched getsession getpgid setpgid getcap setcap share getattr noatsecure siginh rlimitinh dyntransition setkeycreate setsockcreate getrlimit))) ++ (allow userhelper_type self (process (setexec))) ++ (allow userhelper_type self (fd (use))) ++ (allow userhelper_type self (fifo_file (ioctl read write getattr lock append open))) ++ (allow userhelper_type self (shm (create destroy getattr setattr read write associate unix_read unix_write lock))) ++ (allow userhelper_type self (sem (create destroy getattr setattr read write associate unix_read unix_write))) ++ (allow userhelper_type self (msgq (create destroy getattr setattr read write associate unix_read unix_write enqueue))) ++ (allow userhelper_type self (msg (send receive))) ++ (allow userhelper_type self (unix_dgram_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow userhelper_type self (unix_stream_socket (ioctl read write create getattr setattr lock append bind connect listen accept getopt setopt shutdown))) ++ (allow userhelper_type self (unix_dgram_socket (sendto))) ++ (allow userhelper_type self (unix_stream_socket (connectto))) ++ (allow userhelper_type self (sock_file (read getattr open))) ++ (allow utype userhelper_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype userhelper_type (process (transition))) ++ (typetransition utype userhelper_exec_t process userhelper_type) ++ (allow userhelper_type utype (fd (use))) ++ (allow userhelper_type utype (fifo_file (ioctl read write getattr lock append))) ++ (allow userhelper_type utype (process (sigchld))) ++ (allow userhelper_type userhelper_conf_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow userhelper_type userhelper_conf_t (dir (getattr open search))) ++ (allow userhelper_type userhelper_conf_t (file (ioctl read write getattr lock append open))) ++ (allow userhelper_type userhelper_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (dontaudit utype userhelper_type (process (signal))) ++ (allow userhelper_type sysctl_type (dir (getattr open search))) ++ (allow userhelper_type proc_t (dir (getattr open search))) ++ (allow userhelper_type proc_net_t (dir (getattr open search))) ++ (allow userhelper_type sysctl_type (file (ioctl read getattr lock open))) ++ (allow userhelper_type proc_t (dir (getattr open search))) ++ (allow userhelper_type proc_net_t (dir (getattr open search))) ++ (allow userhelper_type sysctl_type (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type debugfs_t (filesystem (getattr))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type bin_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type bin_t (lnk_file (read getattr))) ++ (allow userhelper_type shell_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow userhelper_type shell_exec_t (file (map))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type bin_t (lnk_file (read getattr))) ++ (allow userhelper_type bin_t (file (ioctl read getattr map execute open))) ++ (allow userhelper_type utype (process (transition))) ++ (allow userhelper_type usr_t (dir (getattr open search))) ++ (allow userhelper_type usr_t (lnk_file (read getattr))) ++ (allow userhelper_type usr_t (file (ioctl read getattr map execute open))) ++ (allow userhelper_type utype (process (transition))) ++ (typetransition userhelper_type bin_t process utype) ++ (typetransition userhelper_type usr_t process utype) ++ (allow userhelper_type privfd (fd (use))) ++ (allow userhelper_type privfd (process (sigchld))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type urandom_device_t (chr_file (ioctl read getattr lock open))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (lnk_file (read getattr))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_lib_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type etc_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type etc_t (dir (getattr open search))) ++ (allow userhelper_type etc_t (file (ioctl read getattr lock open))) ++ (allow userhelper_type etc_t (dir (getattr open search))) ++ (allow userhelper_type etc_t (lnk_file (read getattr))) ++ (allow userhelper_type etc_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type etc_t (dir (getattr open search))) ++ (allow userhelper_type etc_runtime_t (file (ioctl read getattr lock open))) ++ (allow userhelper_type etc_t (dir (getattr open search))) ++ (allow userhelper_type etc_runtime_t (lnk_file (read getattr))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_t (file (ioctl read getattr lock open))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_t (lnk_file (read getattr))) ++ (allow userhelper_type home_root_t (dir (getattr open search))) ++ (allow userhelper_type home_root_t (lnk_file (read getattr))) ++ (allow userhelper_type autofs_t (dir (getattr open search))) ++ (allow userhelper_type autofs_t (dir (getattr open search))) ++ (allow userhelper_type nfs_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type nfs_t (dir (getattr open search))) ++ (allow userhelper_type nfs_t (file (ioctl read getattr lock open))) ++ (allow userhelper_type nfs_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type nfs_t (dir (getattr open search))) ++ (allow userhelper_type nfs_t (lnk_file (read getattr))) ++ (allow userhelper_type security_t (lnk_file (read getattr))) ++ (allow userhelper_type sysfs_t (filesystem (getattr))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type security_t (filesystem (getattr))) ++ (allow userhelper_type sysfs_t (filesystem (getattr))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type security_t (lnk_file (read getattr))) ++ (allow userhelper_type security_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type security_t (file (ioctl read write getattr lock append map open))) ++ (allow userhelper_type security_t (security (check_context))) ++ (allow userhelper_type sysfs_t (filesystem (getattr))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type security_t (lnk_file (read getattr))) ++ (allow userhelper_type security_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type security_t (file (ioctl read write getattr lock append open))) ++ (allow userhelper_type security_t (security (compute_av))) ++ (allow userhelper_type sysfs_t (filesystem (getattr))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type security_t (lnk_file (read getattr))) ++ (allow userhelper_type security_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type security_t (file (ioctl read write getattr lock append open))) ++ (allow userhelper_type security_t (security (compute_create))) ++ (allow userhelper_type sysfs_t (filesystem (getattr))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type security_t (lnk_file (read getattr))) ++ (allow userhelper_type security_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type security_t (file (ioctl read write getattr lock append open))) ++ (allow userhelper_type security_t (security (compute_relabel))) ++ (allow userhelper_type sysfs_t (filesystem (getattr))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type sysfs_t (dir (getattr open search))) ++ (allow userhelper_type security_t (lnk_file (read getattr))) ++ (allow userhelper_type security_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type security_t (file (ioctl read write getattr lock append open))) ++ (allow userhelper_type security_t (security (compute_user))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (lnk_file (read getattr))) ++ (allow userhelper_type devpts_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (lnk_file (read getattr))) ++ (allow userhelper_type ttynode (chr_file (getattr relabelfrom relabelto))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (lnk_file (read getattr))) ++ (allow userhelper_type devpts_t (dir (getattr open search))) ++ (allow userhelper_type devpts_t (chr_file (getattr relabelfrom relabelto))) ++ (allow userhelper_type ptynode (chr_file (getattr relabelfrom relabelto))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (lnk_file (read getattr))) ++ (allow userhelper_type ttynode (chr_file (ioctl read write getattr lock append open))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type device_t (lnk_file (read getattr))) ++ (allow userhelper_type devpts_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type ptynode (chr_file (ioctl read write getattr lock append open))) ++ (allow userhelper_type auth_cache_t (dir (getattr open search))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type bin_t (lnk_file (read getattr))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type chkpwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow userhelper_type chkpwd_t (process (transition))) ++ (typetransition userhelper_type chkpwd_exec_t process chkpwd_t) ++ (allow chkpwd_t userhelper_type (fd (use))) ++ (allow chkpwd_t userhelper_type (fifo_file (ioctl read write getattr lock append))) ++ (allow chkpwd_t userhelper_type (process (sigchld))) ++ (allow userhelper_type chkpwd_exec_t (file (map))) ++ (dontaudit userhelper_type shadow_t (file (ioctl read getattr lock open))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type random_device_t (chr_file (ioctl read getattr lock open))) ++ (allow userhelper_type device_t (dir (getattr open search))) ++ (allow userhelper_type urandom_device_t (chr_file (ioctl read getattr lock open))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_log_t (dir (getattr open search))) ++ (allow userhelper_type faillog_t (dir (getattr open search))) ++ (allow userhelper_type faillog_t (file (ioctl read write getattr lock append open))) ++ (allow userhelper_type self (capability (audit_write))) ++ (allow userhelper_type self (netlink_audit_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown nlmsg_read nlmsg_relay nlmsg_tty_audit))) ++ (allow userhelper_type cert_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type cert_t (dir (getattr open search))) ++ (allow userhelper_type cert_t (file (ioctl read getattr lock open))) ++ (allow userhelper_type cert_t (dir (getattr open search))) ++ (allow userhelper_type cert_t (lnk_file (read getattr))) ++ (allow userhelper_type updpwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow userhelper_type updpwd_t (process (transition))) ++ (typetransition userhelper_type updpwd_exec_t process updpwd_t) ++ (allow updpwd_t userhelper_type (fd (use))) ++ (allow updpwd_t userhelper_type (fifo_file (ioctl read write getattr lock append))) ++ (allow updpwd_t userhelper_type (process (sigchld))) ++ (dontaudit userhelper_type shadow_t (file (ioctl read getattr lock open))) ++ (allow userhelper_type var_t (lnk_file (read getattr))) ++ (allow userhelper_type var_run_t (lnk_file (read getattr))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (getattr open search))) ++ (allow userhelper_type pam_var_run_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow userhelper_type pam_var_run_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_auth_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow userhelper_type var_auth_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow userhelper_type var_auth_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow userhelper_type var_auth_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow userhelper_type var_auth_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow userhelper_type var_auth_t (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow userhelper_type var_t (lnk_file (read getattr))) ++ (allow userhelper_type var_run_t (lnk_file (read getattr))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (getattr open search))) ++ (allow userhelper_type pam_var_console_t (dir (getattr open search))) ++ (allow userhelper_type init_t (fd (use))) ++ (allow userhelper_type var_t (lnk_file (read getattr))) ++ (allow userhelper_type var_run_t (lnk_file (read getattr))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (getattr open search))) ++ (allow userhelper_type initrc_var_run_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow userhelper_type etc_t (dir (getattr open search))) ++ (allow userhelper_type selinux_config_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type selinux_config_t (dir (getattr open search))) ++ (allow userhelper_type selinux_config_t (file (ioctl read getattr lock open))) ++ (allow userhelper_type selinux_config_t (dir (getattr open search))) ++ (allow userhelper_type selinux_config_t (lnk_file (read getattr))) ++ (allow userhelper_type etc_t (dir (getattr open search))) ++ (allow userhelper_type selinux_config_t (dir (getattr open search))) ++ (allow userhelper_type default_context_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type default_context_t (dir (getattr open search))) ++ (allow userhelper_type default_context_t (file (ioctl read getattr lock open))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type bin_t (lnk_file (read getattr))) ++ (allow userhelper_type bin_t (file (ioctl read getattr map execute open))) ++ (allow userhelper_type unpriv_userdomain (process (transition))) ++ (allow userhelper_type usr_t (dir (getattr open search))) ++ (allow userhelper_type usr_t (lnk_file (read getattr))) ++ (allow userhelper_type usr_t (file (ioctl read getattr map execute open))) ++ (allow userhelper_type unpriv_userdomain (process (transition))) ++ (allow unpriv_userdomain userhelper_type (fd (use))) ++ (allow unpriv_userdomain userhelper_type (fifo_file (ioctl read write getattr lock append open))) ++ (allow unpriv_userdomain userhelper_type (process (sigchld))) ++ (allow userhelper_type entry_type (file (ioctl read getattr map execute open))) ++ (allow userhelper_type unpriv_userdomain (process (transition))) ++ (allow unpriv_userdomain userhelper_type (fd (use))) ++ (allow unpriv_userdomain userhelper_type (fifo_file (ioctl read write getattr lock append open))) ++ (allow unpriv_userdomain userhelper_type (process (sigchld))) ++ (typetransition userhelper_type var_run_t file "utmp" initrc_var_run_t) ++ (typetransition userhelper_type var_run_t dir "sudo" pam_var_run_t) ++ (typetransition userhelper_type var_run_t dir "sepermit" pam_var_run_t) ++ (typetransition userhelper_type var_run_t dir "pam_timestamp" pam_var_run_t) ++ (typetransition userhelper_type var_run_t dir "pam_ssh" pam_var_run_t) ++ (typetransition userhelper_type var_run_t dir "pam_mount" pam_var_run_t) ++ (optional confinedom_security_advanced_optional_5 ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require krb5_keytab_t) ++ (allow userhelper_type etc_t (dir (getattr open search))) ++ (allow userhelper_type krb5_keytab_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type krb5_keytab_t (file (ioctl read getattr lock open))) ++ ) ++ (optional confinedom_security_advanced_optional_6 ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require pcscd_var_run_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require pcscd_t) ++ (allow userhelper_type var_t (lnk_file (read getattr))) ++ (allow userhelper_type var_run_t (lnk_file (read getattr))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (getattr open search))) ++ (allow userhelper_type pcscd_var_run_t (dir (getattr open search))) ++ (allow userhelper_type pcscd_var_run_t (file (ioctl read getattr lock open))) ++ (allow userhelper_type var_t (lnk_file (read getattr))) ++ (allow userhelper_type var_run_t (lnk_file (read getattr))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (getattr open search))) ++ (allow userhelper_type pcscd_var_run_t (dir (getattr open search))) ++ (allow userhelper_type pcscd_var_run_t (sock_file (write getattr append open))) ++ (allow userhelper_type pcscd_t (unix_stream_socket (connectto))) ++ ) ++ (optional confinedom_security_advanced_optional_7 ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require samba_var_t) ++ (typeattributeset cil_gen_require winbind_t) ++ (typeattributeset cil_gen_require winbind_var_run_t) ++ (typeattributeset cil_gen_require smbd_var_run_t) ++ (typeattributeset cil_gen_require samba_etc_t) ++ (allow userhelper_type var_t (lnk_file (read getattr))) ++ (allow userhelper_type var_run_t (lnk_file (read getattr))) ++ (allow userhelper_type var_t (dir (getattr open search))) ++ (allow userhelper_type var_run_t (dir (getattr open search))) ++ (allow userhelper_type smbd_var_run_t (dir (getattr open search))) ++ (allow userhelper_type samba_var_t (dir (getattr open search))) ++ (allow userhelper_type winbind_var_run_t (dir (getattr open search))) ++ (allow userhelper_type winbind_var_run_t (sock_file (write getattr append open))) ++ (allow userhelper_type winbind_t (unix_stream_socket (connectto))) ++ (allow userhelper_type etc_t (dir (getattr open search))) ++ (allow userhelper_type samba_etc_t (dir (getattr open search))) ++ (allow userhelper_type samba_etc_t (dir (ioctl read getattr lock open search))) ++ (allow userhelper_type samba_etc_t (dir (getattr open search))) ++ (allow userhelper_type samba_etc_t (file (ioctl read getattr lock open))) ++ ) ++ (optional confinedom_security_advanced_optional_8 ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require rpm_t) ++ (typeattributeset cil_gen_require rpm_exec_t) ++ (typeattributeset cil_gen_require rpm_transition_domain) ++ (typeattributeset cil_gen_require debuginfo_exec_t) ++ (typeattributeset cil_gen_require rpm_transition_domain) ++ (typeattributeset rpm_transition_domain (userhelper_type )) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type bin_t (lnk_file (read getattr))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type rpm_exec_t (file (ioctl read getattr map execute open))) ++ (allow userhelper_type rpm_t (process (transition))) ++ (typetransition userhelper_type rpm_exec_t process rpm_t) ++ (allow rpm_t userhelper_type (fd (use))) ++ (allow rpm_t userhelper_type (fifo_file (ioctl read write getattr lock append))) ++ (allow rpm_t userhelper_type (process (sigchld))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type bin_t (lnk_file (read getattr))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ (allow userhelper_type debuginfo_exec_t (file (ioctl read getattr map execute open))) ++ (allow userhelper_type rpm_t (process (transition))) ++ (typetransition userhelper_type debuginfo_exec_t process rpm_t) ++ (allow rpm_t userhelper_type (fd (use))) ++ (allow rpm_t userhelper_type (fifo_file (ioctl read write getattr lock append))) ++ (allow rpm_t userhelper_type (process (sigchld))) ++ (allow userhelper_type debuginfo_exec_t (dir (getattr open search))) ++ (allow userhelper_type debuginfo_exec_t (lnk_file (read getattr))) ++ ) ++ (optional confinedom_security_advanced_optional_9 ++ (typeattributeset cil_gen_require usr_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require sysadm_t) ++ (booleanif (secure_mode) ++ (false ++ (allow sysadm_t userhelper_type (process (sigchld))) ++ (allow sysadm_t userhelper_type (fifo_file (ioctl read write getattr lock append open))) ++ (allow sysadm_t userhelper_type (fd (use))) ++ (allow userhelper_type sysadm_t (process (transition))) ++ (allow userhelper_type entry_type (file (ioctl read getattr map execute open))) ++ (allow sysadm_t userhelper_type (process (sigchld))) ++ (allow sysadm_t userhelper_type (fifo_file (ioctl read write getattr lock append open))) ++ (allow sysadm_t userhelper_type (fd (use))) ++ (allow userhelper_type sysadm_t (process (transition))) ++ (allow userhelper_type usr_t (file (ioctl read getattr map execute open))) ++ (allow userhelper_type usr_t (lnk_file (read getattr))) ++ (allow userhelper_type usr_t (dir (getattr open search))) ++ (allow userhelper_type sysadm_t (process (transition))) ++ (allow userhelper_type bin_t (file (ioctl read getattr map execute open))) ++ (allow userhelper_type bin_t (lnk_file (read getattr))) ++ (allow userhelper_type bin_t (dir (getattr open search))) ++ ) ++ ) ++ ) ++ ) ++ ) ++) ++ ++(macro confinedom_security_basic_macro ((type utype) (role urole)) ++ (optional confinedom_security_basic_optional_2 ++ (typeattributeset cil_gen_require utype) ++ (typeattributeset cil_gen_require security_t) ++ (typeattributeset cil_gen_require can_load_policy) ++ (typeattributeset cil_gen_require sysfs_t) ++ (typeattributeset cil_gen_require can_load_policy) ++ (typeattributeset can_load_policy (utype )) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype security_t (dir (ioctl read getattr lock open search))) ++ (allow utype security_t (file (ioctl read write getattr lock append open))) ++ (allow utype security_t (lnk_file (read getattr))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype security_t (dir (ioctl read getattr lock open search))) ++ (allow utype security_t (file (ioctl read getattr lock open))) ++ (allow utype security_t (lnk_file (read getattr))) ++ (allow utype security_t (security (read_policy))) ++ ) ++) ++ ++(macro confinedom_sudo_macro ((type utype) (role urole) (type sudo_type) (type sudo_tmp_type)) ++ (optional confinedom_sudo_optional ++ ;(type sudo_type) ++ (roletype object_r sudo_type) ++ ;(type sudo_tmp_type) ++ (roletype object_r sudo_tmp_type) ++ (roleattributeset cil_gen_require urole) ++ (typeattributeset cil_gen_require utype) ++ (typeattributeset cil_gen_require sudo_type) ++ (typeattributeset cil_gen_require kernel_t) ++ (typeattributeset cil_gen_require sudo_exec_t) ++ (typeattributeset cil_gen_require sudo_db_t) ++ (typeattributeset cil_gen_require sudodomain) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset cil_gen_require privfd) ++ (typeattributeset cil_gen_require can_change_process_role) ++ (typeattributeset cil_gen_require userdom_home_manager_type) ++ (typeattributeset cil_gen_require tmpfile) ++ (typeattributeset cil_gen_require tmp_t) ++ (typeattributeset cil_gen_require polymember) ++ (typeattributeset cil_gen_require shell_exec_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require usr_t) ++ (typeattributeset cil_gen_require user_home_t) ++ (typeattributeset cil_gen_require user_tmp_t) ++ (typeattributeset cil_gen_require tmpfs_t) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset cil_gen_require security_t) ++ (typeattributeset cil_gen_require sysfs_t) ++ (typeattributeset cil_gen_require selinux_config_t) ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require chkpwd_t) ++ (typeattributeset cil_gen_require chkpwd_exec_t) ++ (typeattributeset cil_gen_require shadow_t) ++ (typeattributeset cil_gen_require auth_cache_t) ++ (typeattributeset cil_gen_require device_t) ++ (typeattributeset cil_gen_require random_device_t) ++ (typeattributeset cil_gen_require urandom_device_t) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset cil_gen_require faillog_t) ++ (typeattributeset cil_gen_require var_log_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require cert_t) ++ (typeattributeset cil_gen_require updpwd_t) ++ (typeattributeset cil_gen_require updpwd_exec_t) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset cil_gen_require syslogd_var_run_t) ++ (typeattributeset cil_gen_require devpts_t) ++ (typeattributeset cil_gen_require sshd_devpts_t) ++ (typeattributeset cil_gen_require systemd_unit_file_type) ++ (typeattributeset cil_gen_require init_script_file_type) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole sudo_type) ++ (roletype urole chkpwd_t) ++ (roletype urole updpwd_t) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset netlabel_peer_type (sudo_type )) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset corenet_unlabeled_type (sudo_type )) ++ (typeattributeset cil_gen_require privfd) ++ (typeattributeset privfd (sudo_type )) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset syslog_client_type (sudo_type )) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset file_type (sudo_exec_t sudo_tmp_type )) ++ (typeattributeset cil_gen_require tmpfile) ++ (typeattributeset tmpfile (sudo_tmp_type )) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset non_security_file_type (sudo_exec_t sudo_tmp_type )) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset exec_type (sudo_exec_t )) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset application_domain_type (sudo_type )) ++ (typeattributeset cil_gen_require polymember) ++ (typeattributeset polymember (sudo_tmp_type )) ++ (typeattributeset cil_gen_require userdom_home_manager_type) ++ (typeattributeset userdom_home_manager_type (sudo_type )) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset ubac_constrained_type (sudo_type )) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset kernel_system_state_reader (sudo_type )) ++ (typeattributeset cil_gen_require can_change_process_role) ++ (typeattributeset can_change_process_role (sudo_type )) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset application_exec_type (sudo_exec_t )) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset nsswitch_domain (sudo_type )) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset entry_type (sudo_exec_t )) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset non_auth_file_type (sudo_exec_t sudo_tmp_type )) ++ (typeattributeset cil_gen_require sudodomain) ++ (typeattributeset sudodomain (sudo_type )) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset domain (sudo_type )) ++ (allow sudo_type kernel_t (system (module_request))) ++ (allow sudo_type sudo_exec_t (file (entrypoint))) ++ (allow sudo_type sudo_exec_t (file (ioctl read getattr lock map execute open))) ++ (allow sudo_type sudo_tmp_type (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow sudo_type tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (typetransition sudo_type tmp_t file sudo_tmp_type) ++ (allow sudo_type utype (dir (getattr open search))) ++ (allow sudo_type utype (file (ioctl read getattr lock open))) ++ (allow sudo_type utype (key (search))) ++ (allow sudo_type utype (unix_stream_socket (read write connectto))) ++ (allow utype sudo_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype sudo_type (process (transition))) ++ (typetransition utype sudo_exec_t process sudo_type) ++ (allow sudo_type utype (fd (use))) ++ (allow sudo_type utype (fifo_file (ioctl read write getattr lock append))) ++ (allow sudo_type utype (process (sigchld))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (lnk_file (read getattr))) ++ (allow sudo_type shell_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type utype (process (transition))) ++ (typetransition sudo_type shell_exec_t process utype) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (lnk_file (read getattr))) ++ (allow sudo_type bin_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type utype (process (transition))) ++ (allow sudo_type usr_t (dir (getattr open search))) ++ (allow sudo_type usr_t (lnk_file (read getattr))) ++ (allow sudo_type usr_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type utype (process (transition))) ++ (typetransition sudo_type bin_t process utype) ++ (typetransition sudo_type usr_t process utype) ++ (allow sudo_type user_home_t (dir (getattr open search))) ++ (allow sudo_type user_home_t (lnk_file (read getattr))) ++ (allow sudo_type user_home_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type utype (process (transition))) ++ (typetransition sudo_type user_home_t process utype) ++ (allow sudo_type tmpfs_t (dir (getattr open search))) ++ (allow sudo_type tmp_t (dir (getattr open search))) ++ (allow sudo_type tmp_t (lnk_file (read getattr))) ++ (allow sudo_type tmp_t (dir (getattr open search))) ++ (allow sudo_type user_tmp_t (dir (getattr open search))) ++ (allow sudo_type user_tmp_t (lnk_file (read getattr))) ++ (allow sudo_type user_tmp_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type utype (process (transition))) ++ (typetransition sudo_type user_tmp_t process utype) ++ (allow utype sudo_exec_t (file (entrypoint))) ++ (allow utype sudo_exec_t (file (ioctl read getattr lock map execute open))) ++ (allow sudo_type sudo_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type utype (process (transition))) ++ (typetransition sudo_type sudo_exec_t process utype) ++ (allow utype sudo_type (fd (use))) ++ (allow utype sudo_type (fifo_file (ioctl read write getattr lock append open))) ++ (allow utype sudo_type (process (sigchld sigkill sigstop signull signal))) ++ (allow sudo_type security_t (lnk_file (read getattr))) ++ (allow sudo_type sysfs_t (filesystem (getattr))) ++ (allow sudo_type sysfs_t (dir (getattr open search))) ++ (allow sudo_type sysfs_t (dir (getattr open search))) ++ (allow sudo_type security_t (filesystem (getattr))) ++ (allow sudo_type etc_t (dir (getattr open search))) ++ (allow sudo_type selinux_config_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type selinux_config_t (dir (getattr open search))) ++ (allow sudo_type selinux_config_t (file (ioctl read getattr lock open))) ++ (allow sudo_type selinux_config_t (dir (getattr open search))) ++ (allow sudo_type selinux_config_t (lnk_file (read getattr))) ++ (allow sudo_type auth_cache_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (lnk_file (read getattr))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type chkpwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type chkpwd_t (process (transition))) ++ (typetransition sudo_type chkpwd_exec_t process chkpwd_t) ++ (allow chkpwd_t sudo_type (fd (use))) ++ (allow chkpwd_t sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow chkpwd_t sudo_type (process (sigchld))) ++ (allow sudo_type chkpwd_exec_t (file (map))) ++ (dontaudit sudo_type shadow_t (file (ioctl read getattr lock open))) ++ (allow sudo_type device_t (dir (getattr open search))) ++ (allow sudo_type random_device_t (chr_file (ioctl read getattr lock open))) ++ (allow sudo_type device_t (dir (getattr open search))) ++ (allow sudo_type urandom_device_t (chr_file (ioctl read getattr lock open))) ++ (allow sudo_type var_t (dir (getattr open search))) ++ (allow sudo_type var_log_t (dir (getattr open search))) ++ (allow sudo_type faillog_t (dir (getattr open search))) ++ (allow sudo_type faillog_t (file (ioctl read write getattr lock append open))) ++ (allow sudo_type self (capability (audit_write))) ++ (allow sudo_type self (netlink_audit_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown nlmsg_read nlmsg_relay nlmsg_tty_audit))) ++ (allow sudo_type cert_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type cert_t (dir (getattr open search))) ++ (allow sudo_type cert_t (file (ioctl read getattr lock open))) ++ (allow sudo_type cert_t (dir (getattr open search))) ++ (allow sudo_type cert_t (lnk_file (read getattr))) ++ (allow sudo_type updpwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type updpwd_t (process (transition))) ++ (typetransition sudo_type updpwd_exec_t process updpwd_t) ++ (allow updpwd_t sudo_type (fd (use))) ++ (allow updpwd_t sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow updpwd_t sudo_type (process (sigchld))) ++ (dontaudit sudo_type shadow_t (file (ioctl read getattr lock open))) ++ (allow sudo_type updpwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type updpwd_t (process (transition))) ++ (typetransition sudo_type updpwd_exec_t process updpwd_t) ++ (allow updpwd_t sudo_type (fd (use))) ++ (allow updpwd_t sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow updpwd_t sudo_type (process (sigchld))) ++ (dontaudit sudo_type shadow_t (file (ioctl read getattr lock open))) ++ (allow sudo_type syslogd_var_run_t (dir (getattr open search))) ++ (allow sudo_type syslogd_var_run_t (file (ioctl read getattr lock open map))) ++ (allow sudo_type syslogd_var_run_t (dir (getattr open search))) ++ (allow sudo_type syslogd_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type device_t (dir (getattr open search))) ++ (allow sudo_type device_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type device_t (dir (getattr open search))) ++ (allow sudo_type device_t (lnk_file (read getattr))) ++ (allow sudo_type devpts_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type devpts_t (chr_file (ioctl read write getattr lock append open))) ++ (allow sudo_type devpts_t (chr_file (setattr))) ++ (allow sudo_type sshd_devpts_t (chr_file (ioctl read write getattr lock append))) ++ (allow sudo_type systemd_unit_file_type (service (start stop status reload enable disable))) ++ (allow sudo_type init_script_file_type (service (start stop status reload enable disable))) ++ (optional confinedom_sudo_optional_3 ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require krb5_keytab_t) ++ (allow sudo_type etc_t (dir (getattr open search))) ++ (allow sudo_type krb5_keytab_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type krb5_keytab_t (file (ioctl read getattr lock open))) ++ ) ++ (optional confinedom_sudo_optional_4 ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require pcscd_var_run_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require pcscd_t) ++ (allow sudo_type var_t (lnk_file (read getattr))) ++ (allow sudo_type var_run_t (lnk_file (read getattr))) ++ (allow sudo_type var_t (dir (getattr open search))) ++ (allow sudo_type var_run_t (dir (getattr open search))) ++ (allow sudo_type pcscd_var_run_t (dir (getattr open search))) ++ (allow sudo_type pcscd_var_run_t (file (ioctl read getattr lock open))) ++ (allow sudo_type var_t (lnk_file (read getattr))) ++ (allow sudo_type var_run_t (lnk_file (read getattr))) ++ (allow sudo_type var_t (dir (getattr open search))) ++ (allow sudo_type var_run_t (dir (getattr open search))) ++ (allow sudo_type pcscd_var_run_t (dir (getattr open search))) ++ (allow sudo_type pcscd_var_run_t (sock_file (write getattr append open))) ++ (allow sudo_type pcscd_t (unix_stream_socket (connectto))) ++ ) ++ (optional confinedom_sudo_optional_5 ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require samba_var_t) ++ (typeattributeset cil_gen_require winbind_t) ++ (typeattributeset cil_gen_require winbind_var_run_t) ++ (typeattributeset cil_gen_require smbd_var_run_t) ++ (typeattributeset cil_gen_require samba_etc_t) ++ (allow sudo_type var_t (lnk_file (read getattr))) ++ (allow sudo_type var_run_t (lnk_file (read getattr))) ++ (allow sudo_type var_t (dir (getattr open search))) ++ (allow sudo_type var_run_t (dir (getattr open search))) ++ (allow sudo_type smbd_var_run_t (dir (getattr open search))) ++ (allow sudo_type samba_var_t (dir (getattr open search))) ++ (allow sudo_type winbind_var_run_t (dir (getattr open search))) ++ (allow sudo_type winbind_var_run_t (sock_file (write getattr append open))) ++ (allow sudo_type winbind_t (unix_stream_socket (connectto))) ++ (allow sudo_type etc_t (dir (getattr open search))) ++ (allow sudo_type samba_etc_t (dir (getattr open search))) ++ (allow sudo_type samba_etc_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type samba_etc_t (dir (getattr open search))) ++ (allow sudo_type samba_etc_t (file (ioctl read getattr lock open))) ++ ) ++ (optional confinedom_sudo_optional_6 ++ (typeattributeset cil_gen_require mta_user_agent) ++ (typeattributeset cil_gen_require user_mail_t) ++ (typeattributeset cil_gen_require sendmail_exec_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole mta_user_agent) ++ (roletype urole user_mail_t) ++ (allow sudo_type sendmail_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type user_mail_t (process (transition))) ++ (typetransition sudo_type sendmail_exec_t process user_mail_t) ++ (allow user_mail_t sudo_type (fd (use))) ++ (allow user_mail_t sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow user_mail_t sudo_type (process (sigchld))) ++ (allow sudo_type sendmail_exec_t (lnk_file (read getattr))) ++ (allow mta_user_agent sudo_type (fd (use))) ++ (allow mta_user_agent sudo_type (process (sigchld))) ++ (allow mta_user_agent sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow sudo_type user_mail_t (process (signal))) ++ (optional confinedom_sudo_optional_7 ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require exim_t) ++ (typeattributeset cil_gen_require exim_exec_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole exim_t) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (lnk_file (read getattr))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type exim_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type exim_t (process (transition))) ++ (typetransition sudo_type exim_exec_t process exim_t) ++ (allow exim_t sudo_type (fd (use))) ++ (allow exim_t sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow exim_t sudo_type (process (sigchld))) ++ ) ++ (optional confinedom_sudo_optional_8 ++ (typeattributeset cil_gen_require mailman_mail_t) ++ (typeattributeset cil_gen_require mailman_mail_exec_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole mailman_mail_t) ++ (allow mta_user_agent mailman_mail_exec_t (file (ioctl read getattr map execute open))) ++ (allow mta_user_agent mailman_mail_t (process (transition))) ++ (typetransition mta_user_agent mailman_mail_exec_t process mailman_mail_t) ++ (allow mailman_mail_t mta_user_agent (fd (use))) ++ (allow mailman_mail_t mta_user_agent (fifo_file (ioctl read write getattr lock append))) ++ (allow mailman_mail_t mta_user_agent (process (sigchld))) ++ ) ++ ) ++ (optional confinedom_sudo_optional_9 ++ (roleattributeset cil_gen_require rpm_script_roles) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require rpm_t) ++ (typeattributeset cil_gen_require rpm_script_t) ++ (typeattributeset cil_gen_require rpm_exec_t) ++ (typeattributeset cil_gen_require rpm_transition_domain) ++ (typeattributeset cil_gen_require debuginfo_exec_t) ++ (typeattributeset cil_gen_require can_system_change) ++ (roleattributeset cil_gen_require rpm_script_roles) ++ (roleattributeset rpm_script_roles (urole )) ++ (typeattributeset cil_gen_require rpm_transition_domain) ++ (typeattributeset rpm_transition_domain (sudo_type )) ++ (typeattributeset cil_gen_require can_system_change) ++ (typeattributeset can_system_change (sudo_type )) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (lnk_file (read getattr))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type rpm_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type rpm_t (process (transition))) ++ (typetransition sudo_type rpm_exec_t process rpm_t) ++ (allow rpm_t sudo_type (fd (use))) ++ (allow rpm_t sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow rpm_t sudo_type (process (sigchld))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (lnk_file (read getattr))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type debuginfo_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type rpm_t (process (transition))) ++ (typetransition sudo_type debuginfo_exec_t process rpm_t) ++ (allow rpm_t sudo_type (fd (use))) ++ (allow rpm_t sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow rpm_t sudo_type (process (sigchld))) ++ (allow sudo_type debuginfo_exec_t (dir (getattr open search))) ++ (allow sudo_type debuginfo_exec_t (lnk_file (read getattr))) ++ (allow sudo_type rpm_script_t (process (transition))) ++ (allow sudo_type rpm_script_t (fd (use))) ++ (allow rpm_script_t sudo_type (fd (use))) ++ (allow rpm_script_t sudo_type (fifo_file (ioctl read write getattr lock append open))) ++ (allow rpm_script_t sudo_type (process (sigchld))) ++ ) ++ (optional confinedom_sudo_optional_10 ++ (typeattributeset cil_gen_require tmp_t) ++ (typeattributeset cil_gen_require tmpfs_t) ++ (typeattributeset cil_gen_require security_t) ++ (typeattributeset cil_gen_require sysfs_t) ++ (typeattributeset cil_gen_require selinux_config_t) ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require krb5_host_rcache_t) ++ (typeattributeset cil_gen_require can_change_object_identity) ++ (typeattributeset cil_gen_require default_context_t) ++ (typeattributeset cil_gen_require file_context_t) ++ (typeattributeset cil_gen_require krb5_conf_t) ++ (typeattributeset cil_gen_require krb5_home_t) ++ (typeattributeset cil_gen_require can_change_object_identity) ++ (typeattributeset can_change_object_identity (sudo_type )) ++ (allow sudo_type etc_t (dir (getattr open search))) ++ (allow sudo_type krb5_conf_t (file (ioctl read getattr lock open))) ++ (allow sudo_type krb5_home_t (file (ioctl read getattr lock open))) ++ (booleanif (kerberos_enabled) ++ (true ++ (allow sudo_type tmp_t (dir (getattr open search))) ++ (allow sudo_type tmp_t (lnk_file (read getattr))) ++ (allow sudo_type tmp_t (dir (getattr open search))) ++ (allow sudo_type tmpfs_t (dir (getattr open search))) ++ (allow sudo_type krb5_host_rcache_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow sudo_type krb5_host_rcache_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow sudo_type tmp_t (dir (getattr open search))) ++ (allow sudo_type tmp_t (lnk_file (read getattr))) ++ (allow sudo_type tmp_t (dir (getattr open search))) ++ (allow sudo_type tmpfs_t (dir (getattr open search))) ++ (allow sudo_type file_context_t (file (map))) ++ (allow sudo_type file_context_t (lnk_file (read getattr))) ++ (allow sudo_type file_context_t (dir (getattr open search))) ++ (allow sudo_type file_context_t (file (ioctl read getattr lock open))) ++ (allow sudo_type file_context_t (dir (getattr open search))) ++ (allow sudo_type file_context_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type file_context_t (dir (getattr open search))) ++ (allow sudo_type selinux_config_t (dir (getattr open search))) ++ (allow sudo_type default_context_t (dir (getattr open search))) ++ (allow sudo_type etc_t (dir (getattr open search))) ++ (allow sudo_type security_t (security (check_context))) ++ (allow sudo_type security_t (file (ioctl read write getattr lock append map open))) ++ (allow sudo_type security_t (dir (ioctl read getattr lock open search))) ++ (allow sudo_type security_t (lnk_file (read getattr))) ++ (allow sudo_type sysfs_t (dir (getattr open search))) ++ (allow sudo_type sysfs_t (dir (getattr open search))) ++ (allow sudo_type sysfs_t (filesystem (getattr))) ++ (allow sudo_type self (process (setfscreate))) ++ ) ++ ) ++ ) ++ (optional confinedom_sudo_optional_11 ++ (typeattributeset cil_gen_require systemd_systemctl_exec_t) ++ (allow sudo_type systemd_systemctl_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type utype (process (transition))) ++ (typetransition sudo_type systemd_systemctl_exec_t process utype) ++ (allow utype systemd_systemctl_exec_t (file (entrypoint))) ++ ) ++ (optional confinedom_sudo_optional_12 ++ (typeattributeset cil_gen_require tmp_t) ++ (typeattributeset cil_gen_require user_tmp_t) ++ (typeattributeset cil_gen_require tmpfs_t) ++ (allow sudo_type user_tmp_t (sock_file (write getattr append open))) ++ (allow sudo_type tmpfs_t (dir (getattr open search))) ++ (allow sudo_type tmp_t (dir (getattr open search))) ++ (allow sudo_type tmp_t (lnk_file (read getattr))) ++ (allow sudo_type tmp_t (dir (getattr open search))) ++ (optional confinedom_sudo_optional_13 ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require passwd_t) ++ (typeattributeset cil_gen_require passwd_exec_t) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (lnk_file (read getattr))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type bin_t (dir (getattr open search))) ++ (allow sudo_type passwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow sudo_type passwd_t (process (transition))) ++ (typetransition sudo_type passwd_exec_t process passwd_t) ++ (allow passwd_t sudo_type (fd (use))) ++ (allow passwd_t sudo_type (fifo_file (ioctl read write getattr lock append))) ++ (allow passwd_t sudo_type (process (sigchld))) ++ ) ++ ) ++ ) ++) ++ ++(macro confinedom_user_login_macro ((type utype) (role urole) (type gkeyringd_type) (type dbusd_type) (boolean exec_content_bool)) ++ (optional confinedom_user_login_optional_2 ++ (roletype object_r utype) ++ (typeattributeset cil_gen_require userdomain) ++ (typeattributeset cil_gen_require login_confinedom) ++ (typeattributeset cil_gen_require user_devpts_t) ++ (typeattributeset cil_gen_require user_tty_device_t) ++ (typeattributeset cil_gen_require shell_exec_t) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset cil_gen_require process_user_target) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset cil_gen_require userdom_filetrans_type) ++ (typeattributeset cil_gen_require user_tmp_t) ++ (typeattributeset cil_gen_require user_tmp_type) ++ (typeattributeset cil_gen_require tmp_t) ++ (typeattributeset cil_gen_require tmpfs_t) ++ (typeattributeset cil_gen_require user_home_dir_t) ++ (typeattributeset cil_gen_require user_home_t) ++ (typeattributeset cil_gen_require user_home_type) ++ (typeattributeset cil_gen_require home_root_t) ++ (typeattributeset cil_gen_require user_home_content_type) ++ (typeattributeset cil_gen_require polymember) ++ (typeattributeset cil_gen_require nfs_t) ++ (typeattributeset cil_gen_require cifs_t) ++ (typeattributeset cil_gen_require bsdpty_device_t) ++ (typeattributeset cil_gen_require devpts_t) ++ (typeattributeset cil_gen_require ptmx_t) ++ (typeattributeset cil_gen_require device_t) ++ (typeattributeset cil_gen_require ttynode) ++ (typeattributeset cil_gen_require ptynode) ++ (typeattributeset cil_gen_require console_device_t) ++ (typeattributeset cil_gen_require tty_device_t) ++ (typeattributeset cil_gen_require server_ptynode) ++ (typeattributeset cil_gen_require device_node) ++ (typeattributeset cil_gen_require virtio_device_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require base_ro_file_type) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset cil_gen_require chkpwd_t) ++ (typeattributeset cil_gen_require chkpwd_exec_t) ++ (typeattributeset cil_gen_require shadow_t) ++ (typeattributeset cil_gen_require updpwd_t) ++ (typeattributeset cil_gen_require updpwd_exec_t) ++ (typeattributeset cil_gen_require passwd_file_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require init_t) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset cil_gen_require boot_t) ++ (typeattributeset cil_gen_require cgroup_t) ++ (typeattributeset cil_gen_require filesystem_type) ++ (typeattributeset cil_gen_require fs_t) ++ (typeattributeset cil_gen_require sysfs_t) ++ (typeattributeset cil_gen_require init_exec_t) ++ (typeattributeset cil_gen_require systemd_systemctl_exec_t) ++ (typeattributeset cil_gen_require efivarfs_t) ++ (typeattributeset cil_gen_require systemd_unit_file_type) ++ (typeattributeset cil_gen_require init_var_run_t) ++ (typeattributeset cil_gen_require systemd_logind_var_run_t) ++ (typeattributeset cil_gen_require systemd_passwd_agent_t) ++ (typeattributeset cil_gen_require systemd_passwd_agent_exec_t) ++ (typeattributeset cil_gen_require systemd_passwd_var_run_t) ++ (typeattributeset cil_gen_require kernel_t) ++ (typeattributeset cil_gen_require sysctl_type) ++ (typeattributeset cil_gen_require proc_t) ++ (typeattributeset cil_gen_require proc_net_t) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset cil_gen_require locale_t) ++ (typeattributeset cil_gen_require mount_var_run_t) ++ (typeattributeset cil_gen_require sound_device_t) ++ (typeattributeset cil_gen_require security_t) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset cil_gen_require selinux_config_t) ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require default_context_t) ++ (typeattributeset cil_gen_require file_context_t) ++ (typeattributeset cil_gen_require fixed_disk_device_t) ++ (typeattributeset cil_gen_require systemd_hostnamed_t) ++ (typeattributeset cil_gen_require systemd_tmpfiles_exec_t) ++ (typeattributeset cil_gen_require udev_var_run_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole utype) ++ (roletype urole user_tmp_t) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset netlabel_peer_type (utype )) ++ (typeattributeset cil_gen_require login_confinedom) ++ (typeattributeset login_confinedom (utype )) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset corenet_unlabeled_type (utype )) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset syslog_client_type (utype )) ++ (typeattributeset cil_gen_require device_node) ++ (typeattributeset device_node (user_devpts_t )) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset file_type (utype shell_exec_t )) ++ (typeattributeset cil_gen_require ptynode) ++ (typeattributeset ptynode (user_devpts_t )) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset non_security_file_type (utype shell_exec_t )) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset exec_type (shell_exec_t )) ++ (typeattributeset cil_gen_require user_home_content_type) ++ (typeattributeset user_home_content_type (utype )) ++ (typeattributeset cil_gen_require polymember) ++ (typeattributeset polymember (utype )) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset ubac_constrained_type (utype )) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset kernel_system_state_reader (utype )) ++ (typeattributeset cil_gen_require userdom_filetrans_type) ++ (typeattributeset userdom_filetrans_type (utype )) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset nsswitch_domain (utype )) ++ (typeattributeset cil_gen_require user_home_type) ++ (typeattributeset user_home_type (utype )) ++ (typeattributeset cil_gen_require userdomain) ++ (typeattributeset userdomain (utype )) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset entry_type (shell_exec_t )) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset non_auth_file_type (utype shell_exec_t )) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset domain (utype )) ++ (typeattributeset cil_gen_require process_user_target) ++ (typeattributeset process_user_target (utype )) ++ (allow utype shell_exec_t (file (entrypoint))) ++ (allow utype shell_exec_t (file (ioctl read getattr lock map execute open))) ++ (allow utype user_tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_tmp_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype user_tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_tmp_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (typemember utype tmp_t dir user_tmp_t) ++ (allow utype user_tmp_type (dir (mounton))) ++ (allow utype user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_tmp_type (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_tmp_type (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_tmp_type (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow utype user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_tmp_type (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_tmp_type (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (typetransition utype tmp_t fifo_file user_tmp_t) ++ (typetransition utype tmp_t sock_file user_tmp_t) ++ (typetransition utype tmp_t lnk_file user_tmp_t) ++ (typetransition utype tmp_t dir user_tmp_t) ++ (typetransition utype tmp_t file user_tmp_t) ++ (allow user_tmp_t tmpfs_t (filesystem (associate))) ++ (allow utype tmpfs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (typetransition utype tmpfs_t fifo_file user_tmp_t) ++ (typetransition utype tmpfs_t sock_file user_tmp_t) ++ (typetransition utype tmpfs_t lnk_file user_tmp_t) ++ (typetransition utype tmpfs_t dir user_tmp_t) ++ (typetransition utype tmpfs_t file user_tmp_t) ++ (allow utype user_tmp_type (dir (getattr open search))) ++ (allow utype user_tmp_type (dir (getattr relabelfrom relabelto))) ++ (allow utype user_tmp_type (dir (getattr open search))) ++ (allow utype user_tmp_type (file (getattr relabelfrom relabelto))) ++ (allow utype user_tmp_type (dir (getattr open search))) ++ (allow utype user_tmp_type (lnk_file (getattr relabelfrom relabelto))) ++ (allow utype user_tmp_type (dir (getattr open search))) ++ (allow utype user_tmp_type (sock_file (getattr relabelfrom relabelto))) ++ (allow utype user_tmp_type (dir (getattr open search))) ++ (allow utype user_tmp_type (fifo_file (getattr relabelfrom relabelto))) ++ (allow utype user_tmp_type (file (map))) ++ (allow utype home_root_t (dir (ioctl read getattr lock open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_home_type (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype user_home_dir_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (typetransition utype user_home_dir_t fifo_file user_home_t) ++ (typetransition utype user_home_dir_t sock_file user_home_t) ++ (typetransition utype user_home_dir_t lnk_file user_home_t) ++ (typetransition utype user_home_dir_t dir user_home_t) ++ (typetransition utype user_home_dir_t file user_home_t) ++ (allow login_confinedom self (capability (mknod))) ++ (allow login_confinedom user_tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow login_confinedom user_tmp_t (chr_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow login_confinedom tmpfs_t (dir (getattr open search))) ++ (allow login_confinedom tmp_t (dir (getattr open search))) ++ (allow login_confinedom tmp_t (lnk_file (read getattr))) ++ (allow login_confinedom tmp_t (dir (getattr open search))) ++ (allow utype user_tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype user_tmp_t (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype tmp_t (dir (getattr open search))) ++ (allow utype tmp_t (lnk_file (read getattr))) ++ (allow utype tmp_t (dir (getattr open search))) ++ (allow utype user_home_t (filesystem (associate))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (dir (ioctl read getattr lock open search))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (lnk_file (read getattr))) ++ (allow utype ptmx_t (chr_file (ioctl read write getattr lock append open))) ++ (allow utype devpts_t (dir (ioctl read getattr lock open search))) ++ (allow utype devpts_t (filesystem (getattr))) ++ (dontaudit utype bsdpty_device_t (chr_file (read write getattr))) ++ (typetransition utype devpts_t chr_file user_devpts_t) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (dir (ioctl read getattr lock open search))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (lnk_file (read getattr))) ++ (allow utype devpts_t (dir (ioctl read getattr lock open search))) ++ (allow utype devpts_t (chr_file (ioctl read write getattr lock append open))) ++ (allow utype ttynode (chr_file (ioctl read write getattr lock append open))) ++ (allow utype ptynode (chr_file (ioctl read write getattr lock append open))) ++ (allow utype console_device_t (chr_file (ioctl read write getattr lock append open))) ++ (allow utype tty_device_t (chr_file (ioctl read write getattr lock append open))) ++ (allow user_devpts_t devpts_t (filesystem (associate))) ++ (allow utype user_devpts_t (chr_file (setattr))) ++ (typechange utype server_ptynode chr_file user_devpts_t) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (dir (ioctl read getattr lock open search))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (lnk_file (read getattr))) ++ (allow utype virtio_device_t (chr_file (ioctl read write getattr lock append open))) ++ (allow utype utype (capability (chown dac_read_search setgid setuid audit_write))) ++ (allow utype utype (dbus (acquire_svc))) ++ (allow utype utype (process (setsched setcap setfscreate setsockcreate))) ++ (allow utype utype (netlink_audit_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown nlmsg_read nlmsg_write nlmsg_relay))) ++ (allow utype utype (netlink_kobject_uevent_socket (create getattr bind getopt setopt))) ++ (allow utype utype (unix_dgram_socket (ioctl create bind connect getopt setopt sendto))) ++ (allow utype utype (unix_stream_socket (connectto))) ++ (allow utype utype (context (contains))) ++ (dontaudit utype exec_type (file (execute execute_no_trans))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (ioctl read getattr lock open search))) ++ (allow utype bin_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype base_ro_file_type (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (ioctl read getattr lock open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype shell_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype shell_exec_t (file (map))) ++ (allow utype application_exec_type (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype chkpwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype chkpwd_t (process (transition))) ++ (typetransition utype chkpwd_exec_t process chkpwd_t) ++ (allow chkpwd_t utype (fd (use))) ++ (allow chkpwd_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow chkpwd_t utype (process (sigchld))) ++ (dontaudit utype shadow_t (file (read getattr))) ++ (allow utype updpwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype updpwd_t (process (transition))) ++ (typetransition utype updpwd_exec_t process updpwd_t) ++ (allow updpwd_t utype (fd (use))) ++ (allow updpwd_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow updpwd_t utype (process (sigchld))) ++ (dontaudit utype shadow_t (file (ioctl read getattr lock open))) ++ (allow utype passwd_file_t (file (ioctl read getattr lock open))) ++ (allow utype init_t (dbus (send_msg))) ++ (allow init_t utype (dbus (send_msg))) ++ (dontaudit utype boot_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (dontaudit utype boot_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype cgroup_t (filesystem (getattr))) ++ (allow utype filesystem_type (dir (getattr))) ++ (allow utype tmpfs_t (filesystem (getattr))) ++ (allow utype fs_t (filesystem (getattr))) ++ (allow utype cgroup_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype cgroup_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype cgroup_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype cgroup_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype cgroup_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype cgroup_t (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype tmpfs_t (file (ioctl read getattr lock open))) ++ (allow utype filesystem_type (dir (getattr open search))) ++ (allow utype init_exec_t (file (entrypoint))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype init_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype init_t (system (status))) ++ (allow utype init_t (service (status))) ++ (allow utype kernel_t (unix_dgram_socket (sendto))) ++ (allow utype sysctl_type (dir (getattr open search))) ++ (allow utype proc_t (dir (getattr open search))) ++ (allow utype proc_net_t (dir (getattr open search))) ++ (allow utype sysctl_type (file (ioctl read getattr lock open))) ++ (allow utype proc_t (dir (getattr open search))) ++ (allow utype proc_net_t (dir (getattr open search))) ++ (allow utype sysctl_type (dir (ioctl read getattr lock open search))) ++ (allow utype proc_t (dir (getattr open search))) ++ (allow utype proc_net_t (dir (getattr open search))) ++ (allow utype proc_net_t (file (ioctl read getattr lock open))) ++ (allow utype proc_t (dir (getattr open search))) ++ (allow utype proc_net_t (dir (getattr open search))) ++ (allow utype proc_net_t (lnk_file (read getattr))) ++ (allow utype proc_t (dir (getattr open search))) ++ (allow utype proc_net_t (dir (ioctl read getattr lock open search))) ++ (allow utype kernel_t (system (module_request))) ++ (allow utype kernel_t (unix_stream_socket (getattr connectto))) ++ (allow utype locale_t (dir (getattr open search))) ++ (allow utype locale_t (lnk_file (getattr watch))) ++ (allow utype mount_var_run_t (dir (getattr open search))) ++ (allow utype mount_var_run_t (file (ioctl read getattr lock open))) ++ (allow utype mount_var_run_t (dir (getattr open search))) ++ (allow utype mount_var_run_t (dir (ioctl read getattr lock open search watch watch_reads))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype mount_var_run_t (dir (getattr open search))) ++ (allow utype mount_var_run_t (dir (getattr watch))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype sound_device_t (chr_file (getattr))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (file (ioctl read getattr lock open))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (lnk_file (read getattr))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (ioctl read getattr lock open search))) ++ (allow utype proc_t (dir (getattr open search))) ++ (allow utype proc_t (dir (getattr open search))) ++ (allow utype domain (dir (ioctl read getattr lock open search))) ++ (allow utype domain (dir (getattr open search))) ++ (allow utype domain (file (ioctl read getattr lock open))) ++ (allow utype domain (dir (getattr open search))) ++ (allow utype domain (lnk_file (read getattr))) ++ (allow utype sysfs_t (filesystem (getattr))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype security_t (lnk_file (read getattr))) ++ (allow utype security_t (dir (ioctl read getattr lock open search))) ++ (allow utype security_t (file (ioctl read write getattr lock append open))) ++ (allow utype security_t (security (compute_av))) ++ (allow utype sysfs_t (filesystem (getattr))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype security_t (lnk_file (read getattr))) ++ (allow utype security_t (dir (ioctl read getattr lock open search))) ++ (allow utype security_t (file (ioctl read write getattr lock append open))) ++ (allow utype security_t (security (compute_create))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype security_t (lnk_file (read getattr))) ++ (allow utype sysfs_t (filesystem (getattr))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype security_t (filesystem (getattr))) ++ (allow utype security_t (dir (ioctl read getattr lock open search))) ++ (allow utype security_t (file (ioctl read getattr map open))) ++ (allow utype security_t (lnk_file (read getattr))) ++ (allow utype etc_t (dir (getattr open search))) ++ (allow utype selinux_config_t (dir (ioctl read getattr lock open search))) ++ (allow utype selinux_config_t (dir (getattr open search))) ++ (allow utype selinux_config_t (file (ioctl read getattr lock open))) ++ (allow utype selinux_config_t (dir (getattr open search))) ++ (allow utype selinux_config_t (lnk_file (read getattr))) ++ (allow utype etc_t (dir (getattr open search))) ++ (allow utype selinux_config_t (dir (getattr open search))) ++ (allow utype default_context_t (dir (getattr open search))) ++ (allow utype file_context_t (dir (getattr open search))) ++ (allow utype file_context_t (dir (ioctl read getattr lock open search))) ++ (allow utype file_context_t (dir (getattr open search))) ++ (allow utype file_context_t (file (ioctl read getattr lock open))) ++ (allow utype file_context_t (dir (getattr open search))) ++ (allow utype file_context_t (lnk_file (read getattr))) ++ (allow utype file_context_t (file (map))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (dir (ioctl read getattr lock open search))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (lnk_file (read getattr))) ++ (allow utype fixed_disk_device_t (blk_file (getattr))) ++ (allow utype systemd_hostnamed_t (dbus (send_msg))) ++ (allow systemd_hostnamed_t utype (dbus (send_msg))) ++ (allow systemd_hostnamed_t utype (dir (ioctl read getattr lock open search))) ++ (allow systemd_hostnamed_t utype (file (ioctl read getattr lock open))) ++ (allow systemd_hostnamed_t utype (lnk_file (read getattr))) ++ (allow systemd_hostnamed_t utype (process (getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype systemd_systemctl_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (dir (ioctl read getattr lock open search))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (file (ioctl read getattr lock open))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (lnk_file (read getattr))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype efivarfs_t (dir (getattr open search))) ++ (allow utype efivarfs_t (file (ioctl read getattr lock open))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype systemd_unit_file_type (dir (ioctl read getattr lock open search))) ++ (allow utype init_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow utype init_t (dir (getattr open search))) ++ (allow utype init_t (file (ioctl read getattr lock open))) ++ (allow utype init_t (lnk_file (read getattr))) ++ (allow utype init_t (unix_stream_socket (sendto))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype init_var_run_t (dir (getattr open search))) ++ (allow utype init_var_run_t (sock_file (write getattr append open))) ++ (allow utype init_t (unix_stream_socket (connectto))) ++ (allow utype init_t (unix_stream_socket (getattr))) ++ (dontaudit utype self (process (setrlimit))) ++ (dontaudit utype self (capability (sys_resource))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (file (ioctl read getattr lock open))) ++ (allow utype systemd_passwd_agent_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype init_var_run_t (dir (getattr open search))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow systemd_passwd_agent_t utype (process (signull))) ++ (allow systemd_passwd_agent_t utype (unix_dgram_socket (sendto))) ++ (dontaudit utype self (capability (net_admin sys_ptrace))) ++ (allow utype systemd_tmpfiles_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype systemd_passwd_var_run_t (dir (getattr watch))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype systemd_unit_file_type (file (ioctl read getattr lock open))) ++ (allow utype systemd_unit_file_type (lnk_file (read getattr))) ++ (allow utype systemd_unit_file_type (dir (ioctl read getattr lock open search))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (dir (ioctl read getattr lock open search))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (lnk_file (read getattr))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype udev_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow utype udev_var_run_t (dir (getattr open search))) ++ (allow utype udev_var_run_t (file (ioctl read getattr lock open))) ++ (allow utype udev_var_run_t (dir (getattr open search))) ++ (allow utype udev_var_run_t (lnk_file (read getattr))) ++ (roleallow system_r urole) ++ (booleanif (deny_bluetooth) ++ (false ++ (allow utype self (bluetooth_socket (ioctl read write create getattr setattr lock append bind connect listen accept getopt setopt shutdown))) ++ ) ++ ) ++ (booleanif (and (exec_content_bool) (use_samba_home_dirs)) ++ (true ++ (allow utype cifs_t (file (ioctl read getattr map execute open execute_no_trans))) ++ (allow utype cifs_t (dir (getattr open search))) ++ (allow utype cifs_t (dir (ioctl read getattr lock open search))) ++ ) ++ ) ++ (booleanif (and (exec_content_bool) (use_nfs_home_dirs)) ++ (true ++ (allow utype nfs_t (file (ioctl read getattr map execute open execute_no_trans))) ++ (allow utype nfs_t (dir (getattr open search))) ++ (allow utype nfs_t (dir (ioctl read getattr lock open search))) ++ ) ++ ) ++ (booleanif (exec_content_bool) ++ (true ++ (allow utype user_home_type (file (ioctl read getattr map execute open execute_no_trans))) ++ (allow utype user_home_dir_t (dir (getattr open search))) ++ (allow utype user_home_type (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype tmp_t (dir (getattr open search))) ++ (allow utype tmp_t (lnk_file (read getattr))) ++ (allow utype tmp_t (dir (getattr open search))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype user_tmp_t (file (ioctl read getattr map execute open execute_no_trans))) ++ (allow utype user_tmp_t (dir (getattr open search))) ++ (allow utype user_tmp_t (file (entrypoint))) ++ ) ++ ) ++ (optional confinedom_user_login_optional_3 ++ (typeattributeset cil_gen_require sssd_public_t) ++ (typeattributeset cil_gen_require sssd_var_lib_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require sssd_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (allow utype sssd_var_lib_t (dir (getattr open search))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype sssd_public_t (dir (getattr open search))) ++ (allow utype sssd_public_t (dir (ioctl read getattr lock open search))) ++ (allow utype sssd_public_t (dir (getattr open search))) ++ (allow utype sssd_public_t (file (ioctl read getattr lock open))) ++ (allow utype sssd_public_t (file (map))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype sssd_var_lib_t (dir (getattr open search))) ++ (allow utype sssd_var_lib_t (sock_file (write getattr append open))) ++ (allow utype sssd_t (unix_stream_socket (connectto))) ++ ) ++ (optional confinedom_user_login_optional_4 ++ (typeattributeset cil_gen_require tmpfs_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require init_t) ++ (typeattributeset cil_gen_require cgroup_t) ++ (typeattributeset cil_gen_require sysfs_t) ++ (typeattributeset cil_gen_require systemd_systemctl_exec_t) ++ (typeattributeset cil_gen_require efivarfs_t) ++ (typeattributeset cil_gen_require systemd_unit_file_type) ++ (typeattributeset cil_gen_require init_var_run_t) ++ (typeattributeset cil_gen_require systemd_logind_var_run_t) ++ (typeattributeset cil_gen_require systemd_passwd_agent_t) ++ (typeattributeset cil_gen_require systemd_passwd_agent_exec_t) ++ (typeattributeset cil_gen_require systemd_passwd_var_run_t) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype systemd_systemctl_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (dir (ioctl read getattr lock open search))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (file (ioctl read getattr lock open))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (lnk_file (read getattr))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype efivarfs_t (dir (getattr open search))) ++ (allow utype efivarfs_t (file (ioctl read getattr lock open))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype systemd_unit_file_type (dir (ioctl read getattr lock open search))) ++ (allow utype init_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow utype init_t (dir (getattr open search))) ++ (allow utype init_t (file (ioctl read getattr lock open))) ++ (allow utype init_t (lnk_file (read getattr))) ++ (allow utype init_t (unix_stream_socket (sendto))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype init_var_run_t (dir (getattr open search))) ++ (allow utype init_var_run_t (sock_file (write getattr append open))) ++ (allow utype init_t (unix_stream_socket (connectto))) ++ (allow utype init_t (unix_stream_socket (getattr))) ++ (dontaudit utype self (process (setrlimit))) ++ (dontaudit utype self (capability (sys_resource))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (file (ioctl read getattr lock open))) ++ (allow utype systemd_passwd_agent_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype init_var_run_t (dir (getattr open search))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow systemd_passwd_agent_t utype (process (signull))) ++ (allow systemd_passwd_agent_t utype (unix_dgram_socket (sendto))) ++ (dontaudit utype self (capability (net_admin sys_ptrace))) ++ (optional confinedom_user_login_optional_5 ++ (typeattributeset cil_gen_require bluetooth_t) ++ (allow utype bluetooth_t (dbus (send_msg))) ++ (allow bluetooth_t utype (dbus (send_msg))) ++ ) ++ (optional confinedom_user_login_optional_6 ++ (typeattributeset cil_gen_require shell_exec_t) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset cil_gen_require device_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require base_ro_file_type) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset cil_gen_require chkpwd_t) ++ (typeattributeset cil_gen_require chkpwd_exec_t) ++ (typeattributeset cil_gen_require shadow_t) ++ (typeattributeset cil_gen_require updpwd_t) ++ (typeattributeset cil_gen_require updpwd_exec_t) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset cil_gen_require cronjob_t) ++ (typeattributeset cil_gen_require crontab_t) ++ (typeattributeset cil_gen_require crontab_exec_t) ++ (typeattributeset cil_gen_require user_cron_spool_t) ++ (typeattributeset cil_gen_require crond_t) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset cil_gen_require auth_cache_t) ++ (typeattributeset cil_gen_require random_device_t) ++ (typeattributeset cil_gen_require urandom_device_t) ++ (typeattributeset cil_gen_require faillog_t) ++ (typeattributeset cil_gen_require var_log_t) ++ (typeattributeset cil_gen_require cert_t) ++ (typeattributeset cil_gen_require userdom_home_reader_type) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole cronjob_t) ++ (roletype urole crontab_t) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset netlabel_peer_type (utype )) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset corenet_unlabeled_type (utype )) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset syslog_client_type (utype )) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset file_type (crontab_exec_t )) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset non_security_file_type (crontab_exec_t )) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset exec_type (crontab_exec_t )) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset application_domain_type (utype )) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset ubac_constrained_type (utype )) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset kernel_system_state_reader (utype )) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset application_exec_type (crontab_exec_t )) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset nsswitch_domain (utype )) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset entry_type (crontab_exec_t )) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset non_auth_file_type (crontab_exec_t )) ++ (typeattributeset cil_gen_require userdom_home_reader_type) ++ (typeattributeset userdom_home_reader_type (utype )) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset domain (utype )) ++ (allow utype crontab_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype crontab_t (process (transition))) ++ (typetransition utype crontab_exec_t process crontab_t) ++ (allow crontab_t utype (fd (use))) ++ (allow crontab_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow crontab_t utype (process (sigchld))) ++ (dontaudit crond_t utype (process (noatsecure siginh rlimitinh))) ++ (allow utype crond_t (process (sigchld))) ++ (allow utype user_cron_spool_t (file (ioctl read write getattr))) ++ (allow utype crontab_t (process (sigchld sigkill sigstop signull signal))) ++ (allow utype crontab_t (dir (ioctl read getattr lock open search))) ++ (allow utype crontab_t (file (ioctl read getattr lock open))) ++ (allow utype crontab_t (lnk_file (read getattr))) ++ (allow utype crontab_t (process (getattr))) ++ (allow utype crontab_exec_t (file (entrypoint))) ++ (allow utype crontab_exec_t (file (ioctl read getattr lock map execute open))) ++ (allow utype auth_cache_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype chkpwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype chkpwd_t (process (transition))) ++ (typetransition utype chkpwd_exec_t process chkpwd_t) ++ (allow chkpwd_t utype (fd (use))) ++ (allow chkpwd_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow chkpwd_t utype (process (sigchld))) ++ (allow utype chkpwd_exec_t (file (map))) ++ (dontaudit utype shadow_t (file (ioctl read getattr lock open))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype random_device_t (chr_file (ioctl read getattr lock open))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype urandom_device_t (chr_file (ioctl read getattr lock open))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_log_t (dir (getattr open search))) ++ (allow utype faillog_t (dir (getattr open search))) ++ (allow utype faillog_t (file (ioctl read write getattr lock append open))) ++ (allow utype self (capability (audit_write))) ++ (allow utype self (netlink_audit_socket (ioctl read write create getattr setattr lock append bind connect getopt setopt shutdown nlmsg_read nlmsg_relay nlmsg_tty_audit))) ++ (allow utype cert_t (dir (ioctl read getattr lock open search))) ++ (allow utype cert_t (dir (getattr open search))) ++ (allow utype cert_t (file (ioctl read getattr lock open))) ++ (allow utype cert_t (dir (getattr open search))) ++ (allow utype cert_t (lnk_file (read getattr))) ++ (allow utype updpwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype updpwd_t (process (transition))) ++ (typetransition utype updpwd_exec_t process updpwd_t) ++ (allow updpwd_t utype (fd (use))) ++ (allow updpwd_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow updpwd_t utype (process (sigchld))) ++ (dontaudit utype shadow_t (file (ioctl read getattr lock open))) ++ (allow crontab_t bin_t (dir (getattr open search))) ++ (allow crontab_t bin_t (lnk_file (read getattr))) ++ (allow crontab_t bin_t (dir (getattr open search))) ++ (allow crontab_t bin_t (dir (ioctl read getattr lock open search))) ++ (allow crontab_t bin_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow crontab_t base_ro_file_type (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow crontab_t bin_t (dir (getattr open search))) ++ (allow crontab_t bin_t (dir (ioctl read getattr lock open search))) ++ (allow crontab_t bin_t (dir (getattr open search))) ++ (allow crontab_t bin_t (lnk_file (read getattr))) ++ (allow crontab_t shell_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow crontab_t shell_exec_t (file (map))) ++ (booleanif (cron_userdomain_transition) ++ (true ++ (allow utype cronjob_t (process (getattr))) ++ (allow utype cronjob_t (lnk_file (read getattr))) ++ (allow utype cronjob_t (file (ioctl read getattr lock open))) ++ (allow utype cronjob_t (dir (ioctl read getattr lock open search))) ++ (allow utype cronjob_t (process (sigchld sigkill sigstop signull signal))) ++ (allow utype crond_t (fifo_file (ioctl read write getattr lock append open))) ++ (allow utype user_cron_spool_t (file (entrypoint))) ++ (allow crond_t utype (key (view read write search link setattr create))) ++ (allow crond_t utype (fd (use))) ++ (allow crond_t utype (process (transition))) ++ ) ++ (false ++ (dontaudit utype cronjob_t (process (sigchld sigkill sigstop signull signal))) ++ (dontaudit utype crond_t (fifo_file (ioctl read write getattr lock append open))) ++ (dontaudit utype user_cron_spool_t (file (entrypoint))) ++ (dontaudit crond_t utype (key (view read write search link setattr create))) ++ (dontaudit crond_t utype (fd (use))) ++ (dontaudit crond_t utype (process (transition))) ++ ) ++ ) ++ (booleanif (deny_ptrace) ++ (false ++ (allow utype crontab_t (process (ptrace))) ++ ) ++ ) ++ (optional confinedom_user_login_optional_7 ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require krb5_keytab_t) ++ (allow utype etc_t (dir (getattr open search))) ++ (allow utype krb5_keytab_t (dir (ioctl read getattr lock open search))) ++ (allow utype krb5_keytab_t (file (ioctl read getattr lock open))) ++ ) ++ (optional confinedom_user_login_optional_8 ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require pcscd_var_run_t) ++ (typeattributeset cil_gen_require pcscd_t) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype pcscd_var_run_t (dir (getattr open search))) ++ (allow utype pcscd_var_run_t (file (ioctl read getattr lock open))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype pcscd_var_run_t (dir (getattr open search))) ++ (allow utype pcscd_var_run_t (sock_file (write getattr append open))) ++ (allow utype pcscd_t (unix_stream_socket (connectto))) ++ ) ++ (optional confinedom_user_login_optional_9 ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require etc_t) ++ (typeattributeset cil_gen_require samba_var_t) ++ (typeattributeset cil_gen_require winbind_t) ++ (typeattributeset cil_gen_require winbind_var_run_t) ++ (typeattributeset cil_gen_require smbd_var_run_t) ++ (typeattributeset cil_gen_require samba_etc_t) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype smbd_var_run_t (dir (getattr open search))) ++ (allow utype samba_var_t (dir (getattr open search))) ++ (allow utype winbind_var_run_t (dir (getattr open search))) ++ (allow utype winbind_var_run_t (sock_file (write getattr append open))) ++ (allow utype winbind_t (unix_stream_socket (connectto))) ++ (allow utype etc_t (dir (getattr open search))) ++ (allow utype samba_etc_t (dir (getattr open search))) ++ (allow utype samba_etc_t (dir (ioctl read getattr lock open search))) ++ (allow utype samba_etc_t (dir (getattr open search))) ++ (allow utype samba_etc_t (file (ioctl read getattr lock open))) ++ ) ++ (optional confinedom_user_login_optional_10 ++ (typeattributeset cil_gen_require system_dbusd_t) ++ (allow cronjob_t utype (dbus (send_msg))) ++ ) ++ ) ++ (optional confinedom_user_login_optional_11 ++ ;(type dbusd_type) ++ (roletype object_r dbusd_type) ++ (typeattributeset cil_gen_require utype) ++ (typeattributeset cil_gen_require shell_exec_t) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset cil_gen_require sysfs_t) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset cil_gen_require security_t) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset cil_gen_require system_dbusd_t) ++ (typeattributeset cil_gen_require session_dbusd_tmp_t) ++ (typeattributeset cil_gen_require dbusd_unconfined) ++ (typeattributeset cil_gen_require session_bus_type) ++ (typeattributeset cil_gen_require dbusd_exec_t) ++ (typeattributeset cil_gen_require dbusd_etc_t) ++ (typeattributeset cil_gen_require userdom_home_manager_type) ++ (typeattributeset cil_gen_require usr_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole dbusd_type) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset netlabel_peer_type (dbusd_type )) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset corenet_unlabeled_type (dbusd_type )) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset syslog_client_type (dbusd_type )) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset file_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset non_security_file_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset exec_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset application_domain_type (dbusd_type )) ++ (typeattributeset cil_gen_require userdom_home_manager_type) ++ (typeattributeset userdom_home_manager_type (dbusd_type )) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset ubac_constrained_type (dbusd_type )) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset kernel_system_state_reader (dbusd_type )) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset application_exec_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset nsswitch_domain (dbusd_type )) ++ (typeattributeset cil_gen_require session_bus_type) ++ (typeattributeset session_bus_type (dbusd_type )) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset entry_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset non_auth_file_type (dbusd_exec_t )) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset domain (dbusd_type )) ++ (allow utype session_dbusd_tmp_t (dir (ioctl write getattr lock open add_name search))) ++ (allow utype session_dbusd_tmp_t (sock_file (create getattr setattr open))) ++ (allow utype system_dbusd_t (dbus (send_msg))) ++ (allow dbusd_type dbusd_exec_t (file (entrypoint))) ++ (allow dbusd_type dbusd_exec_t (file (ioctl read getattr lock map execute open))) ++ (allow dbusd_type security_t (lnk_file (read getattr))) ++ (allow dbusd_type sysfs_t (filesystem (getattr))) ++ (allow dbusd_type sysfs_t (dir (getattr open search))) ++ (allow dbusd_type sysfs_t (dir (getattr open search))) ++ (allow dbusd_type security_t (filesystem (getattr))) ++ (allow utype dbusd_type (unix_stream_socket (ioctl read write create getattr setattr lock append bind connect listen accept getopt setopt shutdown connectto))) ++ (allow dbusd_type utype (unix_stream_socket (read write getattr accept getopt))) ++ (allow dbusd_type utype (unix_dgram_socket (sendto))) ++ (allow utype dbusd_type (dbus (acquire_svc send_msg))) ++ (allow dbusd_unconfined dbusd_type (dbus (acquire_svc send_msg))) ++ (allow utype system_dbusd_t (dbus (acquire_svc send_msg))) ++ (allow utype dbusd_type (process (noatsecure siginh rlimitinh))) ++ (allow dbusd_type utype (dbus (send_msg))) ++ (allow utype dbusd_type (dbus (send_msg))) ++ (allow dbusd_type utype (system (start reload))) ++ (allow dbusd_type session_dbusd_tmp_t (service (start stop))) ++ (allow utype session_dbusd_tmp_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype session_dbusd_tmp_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow dbusd_type dbusd_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype dbusd_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype dbusd_type (process (transition))) ++ (typetransition utype dbusd_exec_t process dbusd_type) ++ (allow dbusd_type utype (fd (use))) ++ (allow dbusd_type utype (fifo_file (ioctl read write getattr lock append))) ++ (allow dbusd_type utype (process (sigchld))) ++ (allow utype dbusd_type (dir (ioctl read getattr lock open search))) ++ (allow utype dbusd_type (file (ioctl read getattr lock open))) ++ (allow utype dbusd_type (lnk_file (read getattr))) ++ (allow utype dbusd_type (process (getattr))) ++ (allow utype dbusd_type (process (sigchld sigkill sigstop signull signal))) ++ (allow dbusd_type bin_t (dir (getattr open search))) ++ (allow dbusd_type bin_t (lnk_file (read getattr))) ++ (allow dbusd_type bin_t (file (ioctl read getattr map execute open))) ++ (allow dbusd_type utype (process (transition))) ++ (allow dbusd_type usr_t (dir (getattr open search))) ++ (allow dbusd_type usr_t (lnk_file (read getattr))) ++ (allow dbusd_type usr_t (file (ioctl read getattr map execute open))) ++ (allow dbusd_type utype (process (transition))) ++ (typetransition dbusd_type bin_t process utype) ++ (typetransition dbusd_type usr_t process utype) ++ (allow dbusd_type bin_t (dir (getattr open search))) ++ (allow dbusd_type bin_t (dir (ioctl read getattr lock open search))) ++ (allow dbusd_type bin_t (dir (getattr open search))) ++ (allow dbusd_type bin_t (lnk_file (read getattr))) ++ (allow dbusd_type shell_exec_t (file (ioctl read getattr map execute open))) ++ (allow dbusd_type utype (process (transition))) ++ (typetransition dbusd_type shell_exec_t process utype) ++ (allow dbusd_type utype (process (sigkill))) ++ (allow utype dbusd_type (fd (use))) ++ (allow utype dbusd_type (fifo_file (ioctl read write getattr lock append open))) ++ (allow dbusd_type file_type (service (start stop status reload enable disable))) ++ (dontaudit dbusd_type self (capability (net_admin))) ++ (allow utype session_dbusd_tmp_t (dir (getattr open search))) ++ (allow utype session_dbusd_tmp_t (sock_file (write getattr append open))) ++ (booleanif (deny_ptrace) ++ (false ++ (allow utype dbusd_type (process (ptrace))) ++ ) ++ ) ++ (optional confinedom_user_login_optional_12 ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require mozilla_exec_t) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset file_type (mozilla_exec_t )) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset non_security_file_type (mozilla_exec_t )) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset exec_type (mozilla_exec_t )) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset entry_type (mozilla_exec_t )) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset non_auth_file_type (mozilla_exec_t )) ++ (allow utype mozilla_exec_t (file (entrypoint))) ++ (allow utype mozilla_exec_t (file (ioctl read getattr lock map execute open))) ++ (allow dbusd_type mozilla_exec_t (file (ioctl read getattr map execute open))) ++ (allow dbusd_type utype (process (transition))) ++ (typetransition dbusd_type mozilla_exec_t process utype) ++ (allow utype dbusd_type (fd (use))) ++ (allow utype dbusd_type (fifo_file (ioctl read write getattr lock append))) ++ (allow utype dbusd_type (process (sigchld))) ++ ) ++ (optional confinedom_user_login_optional_13 ++ (typeattributeset cil_gen_require systemd_unit_file_t) ++ (allow dbusd_type systemd_unit_file_t (service (start))) ++ ) ++ ) ++ (optional confinedom_user_login_optional_14 ++ ;(type gkeyringd_type) ++ (roletype object_r gkeyringd_type) ++ (roleattributeset cil_gen_require gconfd_roles) ++ (typeattributeset cil_gen_require shell_exec_t) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset cil_gen_require process_user_target) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset cil_gen_require user_tmp_t) ++ (typeattributeset cil_gen_require tmp_t) ++ (typeattributeset cil_gen_require tmpfs_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset cil_gen_require userdom_home_manager_type) ++ (typeattributeset cil_gen_require usr_t) ++ (typeattributeset cil_gen_require gnomedomain) ++ (typeattributeset cil_gen_require gkeyringd_domain) ++ (typeattributeset cil_gen_require gnome_home_type) ++ (typeattributeset cil_gen_require gkeyringd_exec_t) ++ (typeattributeset cil_gen_require gkeyringd_tmp_t) ++ (typeattributeset cil_gen_require gconfd_t) ++ (typeattributeset cil_gen_require gconfd_exec_t) ++ (typeattributeset cil_gen_require gconf_tmp_t) ++ (typeattributeset cil_gen_require cache_home_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype urole gkeyringd_type) ++ (roleattributeset cil_gen_require gconfd_roles) ++ (roleattributeset gconfd_roles (urole )) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset netlabel_peer_type (gkeyringd_type )) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset corenet_unlabeled_type (gkeyringd_type )) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset syslog_client_type (gkeyringd_type )) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset file_type (gkeyringd_exec_t )) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset non_security_file_type (gkeyringd_exec_t )) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset exec_type (gkeyringd_exec_t )) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset application_domain_type (gkeyringd_type )) ++ (typeattributeset cil_gen_require userdom_home_manager_type) ++ (typeattributeset userdom_home_manager_type (gkeyringd_type )) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset ubac_constrained_type (gkeyringd_type )) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset kernel_system_state_reader (gkeyringd_type )) ++ (typeattributeset cil_gen_require gnomedomain) ++ (typeattributeset gnomedomain (gkeyringd_type )) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset application_exec_type (gkeyringd_exec_t )) ++ (typeattributeset cil_gen_require gkeyringd_domain) ++ (typeattributeset gkeyringd_domain (gkeyringd_type )) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset nsswitch_domain (gkeyringd_type )) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset entry_type (gkeyringd_exec_t )) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset non_auth_file_type (gkeyringd_exec_t )) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset domain (gkeyringd_type )) ++ (typeattributeset cil_gen_require process_user_target) ++ (typeattributeset process_user_target (gkeyringd_type )) ++ (allow gkeyringd_type gkeyringd_exec_t (file (entrypoint))) ++ (allow gkeyringd_type gkeyringd_exec_t (file (ioctl read getattr lock map execute open))) ++ (allow utype gconfd_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype gconfd_t (process (transition))) ++ (typetransition utype gconfd_exec_t process gconfd_t) ++ (allow gconfd_t utype (fd (use))) ++ (allow gconfd_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow gconfd_t utype (process (sigchld))) ++ (allow utype gconfd_t (process (sigchld sigkill sigstop signull signal))) ++ (allow utype gconfd_t (unix_stream_socket (connectto))) ++ (allow utype gconfd_t (dir (ioctl read getattr lock open search))) ++ (allow utype gconfd_t (file (ioctl read getattr lock open))) ++ (allow utype gconfd_t (lnk_file (read getattr))) ++ (allow utype gconfd_t (process (getattr))) ++ (allow gkeyringd_type utype (unix_stream_socket (ioctl read write create getattr setattr lock append bind connect listen accept getopt setopt shutdown connectto))) ++ (allow gkeyringd_type self (process (setsched))) ++ (allow utype gkeyringd_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype gkeyringd_type (process (transition))) ++ (typetransition utype gkeyringd_exec_t process gkeyringd_type) ++ (allow gkeyringd_type utype (fd (use))) ++ (allow gkeyringd_type utype (fifo_file (ioctl read write getattr lock append))) ++ (allow gkeyringd_type utype (process (sigchld))) ++ (allow utype gnome_home_type (dir (ioctl read write create getattr setattr lock relabelfrom relabelto unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype gkeyringd_tmp_t (dir (ioctl read write create getattr setattr lock relabelfrom relabelto unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype gconf_tmp_t (dir (ioctl read write create getattr setattr lock relabelfrom relabelto unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow utype gnome_home_type (file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open watch watch_reads))) ++ (allow utype gkeyringd_tmp_t (file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open watch watch_reads))) ++ (allow utype gconf_tmp_t (file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open watch watch_reads))) ++ (allow utype gkeyringd_tmp_t (sock_file (ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open))) ++ (allow utype gkeyringd_type (dir (ioctl read getattr lock open search))) ++ (allow utype gkeyringd_type (file (ioctl read getattr lock open))) ++ (allow utype gkeyringd_type (lnk_file (read getattr))) ++ (allow utype gkeyringd_type (process (getattr))) ++ (allow utype gkeyringd_type (process (sigchld sigkill sigstop signull signal))) ++ (dontaudit utype gkeyringd_exec_t (file (entrypoint))) ++ (allow gkeyringd_type utype (process (sigkill))) ++ (allow utype gkeyringd_type (fd (use))) ++ (allow utype gkeyringd_type (fifo_file (ioctl read write getattr lock append open))) ++ (allow utype gkeyringd_type (dbus (acquire_svc))) ++ (allow utype gkeyringd_tmp_t (dir (getattr open search))) ++ (allow utype gkeyringd_tmp_t (sock_file (write getattr append open))) ++ (allow utype gkeyringd_type (unix_stream_socket (connectto))) ++ (allow gkeyringd_type bin_t (dir (getattr open search))) ++ (allow gkeyringd_type bin_t (lnk_file (read getattr))) ++ (allow gkeyringd_type bin_t (file (ioctl read getattr map execute open))) ++ (allow gkeyringd_type utype (process (transition))) ++ (allow gkeyringd_type usr_t (dir (getattr open search))) ++ (allow gkeyringd_type usr_t (lnk_file (read getattr))) ++ (allow gkeyringd_type usr_t (file (ioctl read getattr map execute open))) ++ (allow gkeyringd_type utype (process (transition))) ++ (typetransition gkeyringd_type bin_t process utype) ++ (typetransition gkeyringd_type usr_t process utype) ++ (allow gkeyringd_type bin_t (dir (getattr open search))) ++ (allow gkeyringd_type bin_t (dir (ioctl read getattr lock open search))) ++ (allow gkeyringd_type bin_t (dir (getattr open search))) ++ (allow gkeyringd_type bin_t (lnk_file (read getattr))) ++ (allow gkeyringd_type shell_exec_t (file (ioctl read getattr map execute open))) ++ (allow gkeyringd_type utype (process (transition))) ++ (typetransition gkeyringd_type shell_exec_t process utype) ++ (allow utype gconf_tmp_t (dir (getattr open search))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype tmp_t (dir (getattr open search))) ++ (allow utype tmp_t (lnk_file (read getattr))) ++ (allow utype tmp_t (dir (getattr open search))) ++ (allow utype user_tmp_t (dir (getattr open search))) ++ (allow utype gkeyringd_tmp_t (dir (getattr open search))) ++ (allow utype gkeyringd_tmp_t (sock_file (write getattr append open))) ++ (allow utype gkeyringd_domain (unix_stream_socket (connectto))) ++ (allow utype cache_home_t (dir (getattr open search))) ++ (allow utype cache_home_t (sock_file (write getattr append open))) ++ (allow utype gkeyringd_domain (unix_stream_socket (connectto))) ++ (allow gkeyringd_type utype (dir (ioctl read getattr lock open search))) ++ (allow gkeyringd_type utype (file (ioctl read getattr lock open))) ++ (allow gkeyringd_type utype (lnk_file (read getattr))) ++ (allow gkeyringd_type utype (process (getattr))) ++ (allow gkeyringd_type user_tmp_t (dir (ioctl read getattr lock open search))) ++ (allow gkeyringd_type user_tmp_t (sock_file (read write getattr append))) ++ (allow gkeyringd_type tmpfs_t (dir (getattr open search))) ++ (allow gkeyringd_type tmp_t (dir (getattr open search))) ++ (allow gkeyringd_type tmp_t (lnk_file (read getattr))) ++ (allow gkeyringd_type tmp_t (dir (getattr open search))) ++ (allow gkeyringd_type utype (dbus (acquire_svc send_msg))) ++ (allow utype gkeyringd_type (dbus (send_msg))) ++ (optional confinedom_user_login_optional_15 ++ (typeattributeset cil_gen_require user_home_dir_t) ++ (typeattributeset cil_gen_require home_root_t) ++ (typeattributeset cil_gen_require system_dbusd_t) ++ (typeattributeset cil_gen_require session_bus_type) ++ (typeattributeset cil_gen_require dbusd_type) ++ (typeattributeset cil_gen_require gnome_home_t) ++ (typeattributeset cil_gen_require data_home_t) ++ (typeattributeset cil_gen_require gconf_home_t) ++ (allow dbusd_type gkeyringd_exec_t (file (ioctl read getattr map execute open))) ++ (allow dbusd_type gkeyringd_type (process (transition))) ++ (typetransition dbusd_type gkeyringd_exec_t process gkeyringd_type) ++ (allow gkeyringd_type dbusd_type (fd (use))) ++ (allow gkeyringd_type dbusd_type (fifo_file (ioctl read write getattr lock append))) ++ (allow gkeyringd_type dbusd_type (process (sigchld))) ++ (allow gkeyringd_type session_bus_type (dbus (send_msg))) ++ (allow gkeyringd_type self (dbus (send_msg))) ++ (allow gkeyringd_type session_bus_type (unix_stream_socket (connectto))) ++ (allow session_bus_type gkeyringd_type (process (sigkill))) ++ (allow gkeyringd_type session_bus_type (dbus (acquire_svc))) ++ (allow gkeyringd_type system_dbusd_t (unix_stream_socket (connectto))) ++ (allow gkeyringd_type system_dbusd_t (dbus (send_msg))) ++ (allow gkeyringd_type user_home_dir_t (dir (getattr open search))) ++ (allow gkeyringd_type user_home_dir_t (lnk_file (read getattr))) ++ (allow gkeyringd_type home_root_t (dir (getattr open search))) ++ (allow gkeyringd_type home_root_t (lnk_file (read getattr))) ++ (allow gkeyringd_type gnome_home_t (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow gkeyringd_type data_home_t (dir (getattr open search))) ++ (allow gkeyringd_type gconf_home_t (dir (getattr open search))) ++ (allow gkeyringd_type data_home_t (file (ioctl read getattr lock open))) ++ (allow gkeyringd_type data_home_t (dir (getattr open search))) ++ (allow gkeyringd_type gconf_home_t (dir (getattr open search))) ++ (allow gkeyringd_type data_home_t (lnk_file (read getattr))) ++ (allow gkeyringd_type data_home_t (dir (getattr open search))) ++ (allow gkeyringd_type gconf_home_t (dir (getattr open search))) ++ (allow gkeyringd_type data_home_t (dir (ioctl read getattr lock open search))) ++ (optional confinedom_user_login_optional_16 ++ (typeattributeset cil_gen_require proc_t) ++ (typeattributeset cil_gen_require telepathy_mission_control_t) ++ (typeattributeset cil_gen_require telepathy_gabble_t) ++ (allow gkeyringd_type proc_t (dir (getattr open search))) ++ (allow gkeyringd_type proc_t (dir (getattr open search))) ++ (allow gkeyringd_type telepathy_mission_control_t (dir (ioctl read getattr lock open search))) ++ (allow gkeyringd_type telepathy_mission_control_t (file (ioctl read getattr lock open))) ++ (allow gkeyringd_type telepathy_mission_control_t (lnk_file (read getattr))) ++ (allow gkeyringd_type telepathy_mission_control_t (process (getattr))) ++ (allow telepathy_gabble_t gkeyringd_tmp_t (dir (getattr open search))) ++ (allow telepathy_gabble_t gkeyringd_tmp_t (sock_file (write getattr append open))) ++ (allow telepathy_gabble_t gkeyringd_type (unix_stream_socket (connectto))) ++ ) ++ (optional confinedom_user_login_optional_17 ++ (typeattributeset cil_gen_require systemd_logind_t) ++ (allow gkeyringd_type systemd_logind_t (dbus (send_msg))) ++ (allow systemd_logind_t gkeyringd_type (dbus (send_msg))) ++ (allow systemd_logind_t gkeyringd_type (dir (ioctl read getattr lock open search))) ++ (allow systemd_logind_t gkeyringd_type (file (ioctl read getattr lock open))) ++ (allow systemd_logind_t gkeyringd_type (lnk_file (read getattr))) ++ (allow systemd_logind_t gkeyringd_type (process (getattr))) ++ (allow systemd_logind_t gkeyringd_type (process (signal))) ++ (allow gkeyringd_type systemd_logind_t (fd (use))) ++ ) ++ ) ++ (optional confinedom_user_login_optional_18 ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require ssh_agent_exec_t) ++ (allow gkeyringd_type bin_t (dir (getattr open search))) ++ (allow gkeyringd_type bin_t (lnk_file (read getattr))) ++ (allow gkeyringd_type bin_t (dir (getattr open search))) ++ (allow gkeyringd_type bin_t (dir (getattr open search))) ++ (allow gkeyringd_type ssh_agent_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ ) ++ ) ++ (optional confinedom_user_login_optional_19 ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require locate_var_lib_t) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype locate_var_lib_t (dir (getattr open search))) ++ (allow utype locate_var_lib_t (file (ioctl read getattr lock open))) ++ (allow utype locate_var_lib_t (dir (ioctl read getattr lock open search))) ++ ) ++ (optional confinedom_user_login_optional_20 ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require mail_spool_t) ++ (typeattributeset cil_gen_require var_spool_t) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_spool_t (dir (getattr open search))) ++ (allow utype mail_spool_t (dir (ioctl read getattr lock open search))) ++ (allow utype mail_spool_t (dir (getattr open search))) ++ (allow utype mail_spool_t (file (getattr))) ++ (allow utype mail_spool_t (dir (getattr open search))) ++ (allow utype mail_spool_t (lnk_file (read getattr))) ++ ) ++ ) ++ ) ++) ++ ++(macro confined_ssh_connect_macro ((type utype) (role urole) (type ssh_agent_type)) ++ (optional confined_ssh_connect_macro_optional ++ (typeattributeset cil_gen_require sshd_t) ++ (typeattributeset cil_gen_require ptmx_t) ++ (typeattributeset cil_gen_require device_t) ++ (typeattributeset cil_gen_require sshd_devpts_t) ++ (typeattributeset cil_gen_require ssh_server) ++ (typeattributeset cil_gen_require ssh_t) ++ (typeattributeset cil_gen_require ssh_exec_t) ++ (typeattributeset cil_gen_require ssh_tmpfs_t) ++ (typeattributeset cil_gen_require ssh_home_t) ++ (typeattributeset cil_gen_require ssh_agent_exec_t) ++ (typeattributeset cil_gen_require ssh_keysign_t) ++ (typeattributeset cil_gen_require ssh_agent_tmp_t) ++ (typeattributeset cil_gen_require cache_home_t) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset cil_gen_require privfd) ++ (typeattributeset cil_gen_require user_home_dir_t) ++ (typeattributeset cil_gen_require home_root_t) ++ (typeattributeset cil_gen_require user_tmp_type) ++ (typeattributeset cil_gen_require user_tmp_t) ++ (typeattributeset cil_gen_require tmp_t) ++ (typeattributeset cil_gen_require tmpfs_t) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset cil_gen_require shell_exec_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require usr_t) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset cil_gen_require tty_device_t) ++ (typeattributeset cil_gen_require user_home_t) ++ (typeattributeset cil_gen_require userdom_home_manager_type) ++ (typeattributeset cil_gen_require ssh_keygen_exec_t) ++ (roleattributeset cil_gen_require urole) ++ (roletype object_r ssh_agent_type) ++ (roletype urole ssh_t) ++ (roletype urole ssh_agent_type) ++ (roletype urole user_tmp_t) ++ (typeattributeset cil_gen_require netlabel_peer_type) ++ (typeattributeset netlabel_peer_type (ssh_agent_type )) ++ (typeattributeset cil_gen_require corenet_unlabeled_type) ++ (typeattributeset corenet_unlabeled_type (ssh_agent_type )) ++ (typeattributeset cil_gen_require privfd) ++ (typeattributeset privfd (ssh_agent_type )) ++ (typeattributeset cil_gen_require syslog_client_type) ++ (typeattributeset syslog_client_type (ssh_agent_type )) ++ (typeattributeset cil_gen_require file_type) ++ (typeattributeset file_type (ssh_agent_exec_t )) ++ (typeattributeset cil_gen_require non_security_file_type) ++ (typeattributeset non_security_file_type (ssh_agent_exec_t )) ++ (typeattributeset cil_gen_require exec_type) ++ (typeattributeset exec_type (ssh_agent_exec_t )) ++ (typeattributeset cil_gen_require application_domain_type) ++ (typeattributeset application_domain_type (ssh_agent_type )) ++ (typeattributeset cil_gen_require userdom_home_manager_type) ++ (typeattributeset userdom_home_manager_type (ssh_agent_type )) ++ (typeattributeset cil_gen_require ubac_constrained_type) ++ (typeattributeset ubac_constrained_type (ssh_agent_type )) ++ (typeattributeset cil_gen_require ssh_agent_type) ++ (typeattributeset cil_gen_require kernel_system_state_reader) ++ (typeattributeset kernel_system_state_reader (ssh_agent_type )) ++ (typeattributeset cil_gen_require application_exec_type) ++ (typeattributeset application_exec_type (ssh_agent_exec_t )) ++ (typeattributeset cil_gen_require nsswitch_domain) ++ (typeattributeset nsswitch_domain (ssh_agent_type )) ++ (typeattributeset cil_gen_require entry_type) ++ (typeattributeset entry_type (ssh_agent_exec_t )) ++ (typeattributeset cil_gen_require non_auth_file_type) ++ (typeattributeset non_auth_file_type (ssh_agent_exec_t )) ++ (typeattributeset cil_gen_require domain) ++ (typeattributeset domain (ssh_agent_type )) ++ (allow sshd_t utype (process (dyntransition))) ++ (allow utype sshd_t (process (sigchld))) ++ (allow sshd_t utype (process (sigkill sigstop signull signal getattr))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (dir (ioctl read getattr lock open search))) ++ (allow utype device_t (dir (getattr open search))) ++ (allow utype device_t (lnk_file (read getattr))) ++ (allow utype ptmx_t (chr_file (ioctl read write getattr lock append open))) ++ (allow utype sshd_devpts_t (chr_file (ioctl read write getattr lock append))) ++ (allow ssh_agent_type ssh_agent_exec_t (file (entrypoint))) ++ (allow ssh_agent_type ssh_agent_exec_t (file (ioctl read getattr lock map execute open))) ++ (allow utype ssh_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype ssh_t (process (transition))) ++ (typetransition utype ssh_exec_t process ssh_t) ++ (allow ssh_t utype (fd (use))) ++ (allow ssh_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow ssh_t utype (process (sigchld))) ++ (allow utype ssh_server (unix_stream_socket (ioctl read write getattr setattr lock append bind connect listen accept getopt setopt shutdown))) ++ (allow utype ssh_t (dir (ioctl read getattr lock open search))) ++ (allow utype ssh_t (file (ioctl read getattr lock open))) ++ (allow utype ssh_t (lnk_file (read getattr))) ++ (allow utype ssh_t (process (getattr))) ++ (allow utype ssh_t (process (sigchld sigkill sigstop signull signal))) ++ (allow ssh_t utype (unix_stream_socket (ioctl read write getattr setattr lock append bind connect getopt setopt shutdown))) ++ (allow ssh_t utype (unix_stream_socket (connectto))) ++ (allow ssh_t utype (key (view read write search link setattr create))) ++ (allow utype ssh_t (key (view read write search))) ++ (allow utype ssh_home_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype ssh_home_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype ssh_home_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype ssh_home_t (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow utype ssh_home_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype ssh_home_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype user_home_dir_t (dir (getattr open search))) ++ (allow utype user_home_dir_t (lnk_file (read getattr))) ++ (allow utype home_root_t (dir (getattr open search))) ++ (allow utype home_root_t (lnk_file (read getattr))) ++ (typemember ssh_t tmp_t dir user_tmp_t) ++ (allow ssh_t user_tmp_type (dir (mounton))) ++ (allow ssh_t user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow ssh_t user_tmp_type (dir (ioctl read write create getattr setattr lock unlink link rename open watch watch_reads add_name remove_name reparent search rmdir))) ++ (allow ssh_t user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow ssh_t user_tmp_type (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow ssh_t user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow ssh_t user_tmp_type (lnk_file (ioctl read write create getattr setattr lock append unlink link rename watch watch_reads))) ++ (allow ssh_t user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow ssh_t user_tmp_type (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow ssh_t user_tmp_type (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow ssh_t user_tmp_type (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow ssh_t tmp_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (typetransition ssh_t tmp_t fifo_file user_tmp_t) ++ (typetransition ssh_t tmp_t sock_file user_tmp_t) ++ (typetransition ssh_t tmp_t lnk_file user_tmp_t) ++ (typetransition ssh_t tmp_t dir user_tmp_t) ++ (typetransition ssh_t tmp_t file user_tmp_t) ++ (allow user_tmp_t tmpfs_t (filesystem (associate))) ++ (allow ssh_t tmpfs_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (typetransition ssh_t tmpfs_t fifo_file user_tmp_t) ++ (typetransition ssh_t tmpfs_t sock_file user_tmp_t) ++ (typetransition ssh_t tmpfs_t lnk_file user_tmp_t) ++ (typetransition ssh_t tmpfs_t dir user_tmp_t) ++ (typetransition ssh_t tmpfs_t file user_tmp_t) ++ (allow ssh_t user_tmp_type (dir (getattr open search))) ++ (allow ssh_t user_tmp_type (dir (getattr relabelfrom relabelto))) ++ (allow ssh_t user_tmp_type (dir (getattr open search))) ++ (allow ssh_t user_tmp_type (file (getattr relabelfrom relabelto))) ++ (allow ssh_t user_tmp_type (dir (getattr open search))) ++ (allow ssh_t user_tmp_type (lnk_file (getattr relabelfrom relabelto))) ++ (allow ssh_t user_tmp_type (dir (getattr open search))) ++ (allow ssh_t user_tmp_type (sock_file (getattr relabelfrom relabelto))) ++ (allow ssh_t user_tmp_type (dir (getattr open search))) ++ (allow ssh_t user_tmp_type (fifo_file (getattr relabelfrom relabelto))) ++ (allow ssh_t user_tmp_type (file (map))) ++ (allow ssh_agent_type utype (process (signull))) ++ (allow ssh_agent_type ssh_agent_type (process (signull))) ++ (allow ssh_agent_type self (unix_stream_socket (ioctl read write create getattr setattr lock append bind connect listen accept getopt setopt shutdown connectto))) ++ (allow utype ssh_agent_tmp_t (dir (getattr open search))) ++ (allow utype ssh_agent_tmp_t (sock_file (write getattr append open))) ++ (allow utype ssh_agent_type (unix_stream_socket (connectto))) ++ (allow utype cache_home_t (dir (getattr open search))) ++ (allow utype cache_home_t (sock_file (write getattr append open))) ++ (allow utype ssh_agent_type (unix_stream_socket (connectto))) ++ (allow utype ssh_agent_type (unix_stream_socket (ioctl read write create getattr setattr lock append bind connect listen accept getopt setopt shutdown))) ++ (allow utype ssh_agent_type (process (sigchld sigkill sigstop signull signal))) ++ (allow utype ssh_agent_type (dir (ioctl read getattr lock open search))) ++ (allow utype ssh_agent_type (file (ioctl read getattr lock open))) ++ (allow utype ssh_agent_type (lnk_file (read getattr))) ++ (allow utype ssh_agent_type (process (getattr))) ++ (allow ssh_agent_type ssh_agent_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype ssh_agent_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype ssh_agent_type (process (transition))) ++ (typetransition utype ssh_agent_exec_t process ssh_agent_type) ++ (allow ssh_agent_type utype (fd (use))) ++ (allow ssh_agent_type utype (fifo_file (ioctl read write getattr lock append))) ++ (allow ssh_agent_type utype (process (sigchld))) ++ (allow ssh_agent_type bin_t (dir (getattr open search))) ++ (allow ssh_agent_type bin_t (dir (ioctl read getattr lock open search))) ++ (allow ssh_agent_type bin_t (dir (getattr open search))) ++ (allow ssh_agent_type bin_t (lnk_file (read getattr))) ++ (allow ssh_agent_type shell_exec_t (file (ioctl read getattr map execute open))) ++ (allow ssh_agent_type utype (process (transition))) ++ (typetransition ssh_agent_type shell_exec_t process utype) ++ (allow ssh_agent_type bin_t (dir (getattr open search))) ++ (allow ssh_agent_type bin_t (lnk_file (read getattr))) ++ (allow ssh_agent_type bin_t (file (ioctl read getattr map execute open))) ++ (allow ssh_agent_type utype (process (transition))) ++ (allow ssh_agent_type usr_t (dir (getattr open search))) ++ (allow ssh_agent_type usr_t (lnk_file (read getattr))) ++ (allow ssh_agent_type usr_t (file (ioctl read getattr map execute open))) ++ (allow ssh_agent_type utype (process (transition))) ++ (typetransition ssh_agent_type bin_t process utype) ++ (typetransition ssh_agent_type usr_t process utype) ++ (allow ssh_agent_type device_t (dir (getattr open search))) ++ (allow ssh_agent_type device_t (dir (ioctl read getattr lock open search))) ++ (allow ssh_agent_type device_t (dir (getattr open search))) ++ (allow ssh_agent_type device_t (lnk_file (read getattr))) ++ (allow ssh_agent_type tty_device_t (chr_file (ioctl read write getattr lock append open))) ++ (allow ssh_agent_type user_home_t (file (ioctl read getattr map execute open))) ++ (allow ssh_agent_type utype (process (transition))) ++ (typetransition ssh_agent_type user_home_t process utype) ++ (allow ssh_agent_type user_home_dir_t (dir (getattr open search))) ++ (allow ssh_agent_type home_root_t (dir (getattr open search))) ++ (allow ssh_agent_type home_root_t (lnk_file (read getattr))) ++ (allow utype ssh_keygen_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ ) ++) ++ ++(macro confined_use_basic_commands_macro ((type utype) (role urole)) ++ (optional confined_use_basic_commands_optional_2 ++ (roleattributeset cil_gen_require urole) ++ (typeattributeset cil_gen_require init_var_lib_t) ++ (typeattributeset cil_gen_require utype) ++ (typeattributeset cil_gen_require login_confinedom) ++ (typeattributeset cil_gen_require var_t) ++ (typeattributeset cil_gen_require var_lib_t) ++ (typeattributeset cil_gen_require init_t) ++ (typeattributeset cil_gen_require var_log_t) ++ (typeattributeset cil_gen_require syslogd_var_run_t) ++ (typeattributeset cil_gen_require systemd_unit_file_type) ++ (typeattributeset cil_gen_require systemd_systemctl_exec_t) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require cgroup_t) ++ (typeattributeset cil_gen_require tmpfs_t) ++ (typeattributeset cil_gen_require sysfs_t) ++ (typeattributeset cil_gen_require efivarfs_t) ++ (typeattributeset cil_gen_require init_var_run_t) ++ (typeattributeset cil_gen_require var_run_t) ++ (typeattributeset cil_gen_require systemd_logind_var_run_t) ++ (typeattributeset cil_gen_require systemd_passwd_agent_t) ++ (typeattributeset cil_gen_require systemd_passwd_agent_exec_t) ++ (typeattributeset cil_gen_require systemd_passwd_var_run_t) ++ (allow utype utype (process (setpgid))) ++ (allow utype utype (system (status))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype init_var_lib_t (dir (getattr open search))) ++ (allow utype init_var_lib_t (file (ioctl read getattr map open))) ++ (allow utype init_t (process (signal))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_log_t (dir (ioctl read getattr lock open search))) ++ (allow utype var_log_t (file (map))) ++ (allow utype var_log_t (dir (getattr open search))) ++ (allow utype var_log_t (file (ioctl read getattr lock open))) ++ (allow utype var_log_t (dir (getattr open search))) ++ (allow utype var_log_t (lnk_file (read getattr))) ++ (allow utype syslogd_var_run_t (dir (getattr open search))) ++ (allow utype syslogd_var_run_t (file (ioctl read getattr lock open map))) ++ (allow utype syslogd_var_run_t (dir (getattr open search))) ++ (allow utype syslogd_var_run_t (dir (ioctl read getattr lock open search))) ++ ;corecmd_bin_entry_type(utype) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (file (entrypoint))) ++ (allow utype bin_t (file (ioctl read getattr lock map execute open))) ++ (allow utype usr_t (file (entrypoint))) ++ (allow utype usr_t (file (ioctl read getattr lock map execute open))) ++ (allow utype systemd_systemctl_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (dir (ioctl read getattr lock open search))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (file (ioctl read getattr lock open))) ++ (allow utype cgroup_t (dir (getattr open search))) ++ (allow utype cgroup_t (lnk_file (read getattr))) ++ (allow utype tmpfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype sysfs_t (dir (getattr open search))) ++ (allow utype efivarfs_t (dir (getattr open search))) ++ (allow utype efivarfs_t (file (ioctl read getattr lock open))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_lib_t (dir (getattr open search))) ++ (allow utype systemd_unit_file_type (dir (ioctl read getattr lock open search))) ++ (allow utype init_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow utype init_t (dir (getattr open search))) ++ (allow utype init_t (file (ioctl read getattr lock open))) ++ (allow utype init_t (lnk_file (read getattr))) ++ (allow utype init_t (unix_stream_socket (sendto))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype init_var_run_t (dir (getattr open search))) ++ (allow utype init_var_run_t (sock_file (write getattr append open))) ++ (allow utype init_t (unix_stream_socket (connectto))) ++ (allow utype init_t (unix_stream_socket (getattr))) ++ (dontaudit utype self (process (setrlimit))) ++ (dontaudit utype self (capability (sys_resource))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (ioctl read getattr lock open search))) ++ (allow utype var_t (lnk_file (read getattr))) ++ (allow utype var_run_t (lnk_file (read getattr))) ++ (allow utype var_t (dir (getattr open search))) ++ (allow utype var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (dir (getattr open search))) ++ (allow utype systemd_logind_var_run_t (file (ioctl read getattr lock open))) ++ (allow utype systemd_passwd_agent_exec_t (file (ioctl read getattr lock map execute open execute_no_trans))) ++ (allow utype init_var_run_t (dir (getattr open search))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (file (ioctl read write create getattr setattr lock append unlink link rename open watch watch_reads))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (sock_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow utype systemd_passwd_var_run_t (dir (ioctl read write getattr lock open add_name remove_name search))) ++ (allow utype systemd_passwd_var_run_t (fifo_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow systemd_passwd_agent_t utype (process (signull))) ++ (allow systemd_passwd_agent_t utype (unix_dgram_socket (sendto))) ++ (dontaudit utype self (capability (net_admin sys_ptrace))) ++ (allow utype systemd_unit_file_type (service (status))) ++ (optional confined_use_basic_commands_optional_3 ++ (typeattributeset cil_gen_require adjtime_t) ++ (typeattributeset cil_gen_require etc_t) ++ (allow utype etc_t (dir (ioctl read getattr lock open search))) ++ (allow utype adjtime_t (file (ioctl read getattr lock open))) ++ ) ++ (optional confined_use_basic_commands_optional_4 ++ (typeattributeset cil_gen_require mandb_cache_t) ++ (allow utype mandb_cache_t (file (map))) ++ ) ++ (optional confined_use_basic_commands_optional_5 ++ (roleattributeset cil_gen_require passwd_roles) ++ (typeattributeset cil_gen_require bin_t) ++ (typeattributeset cil_gen_require passwd_t) ++ (typeattributeset cil_gen_require passwd_exec_t) ++ (roleattributeset cil_gen_require passwd_roles) ++ (roleattributeset passwd_roles (urole )) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (lnk_file (read getattr))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype bin_t (dir (getattr open search))) ++ (allow utype passwd_exec_t (file (ioctl read getattr map execute open))) ++ (allow utype passwd_t (process (transition))) ++ (typetransition utype passwd_exec_t process passwd_t) ++ (allow passwd_t utype (fd (use))) ++ (allow passwd_t utype (fifo_file (ioctl read write getattr lock append))) ++ (allow passwd_t utype (process (sigchld))) ++ ) ++ ) ++) ++ ++;(call confinedom_admin_commands_macro (u_t u_r u_sudo_t)) ++;(call confinedom_graphical_login_macro (u_t u_r u_dbus_t)) ++;(call confinedom_mozilla_usage_macro (u_t u_r)) ++;(call confinedom_networking_macro (u_t u_r)) ++;(call confinedom_security_advanced_macro (u_t u_r u_sudo_t u_userhelper_t)) ++;(call confinedom_security_basic_macro (u_t u_r)) ++;(call confinedom_sudo_macro (u_t u_r u_sudo_t u_sudo_tmp_t)) ++;(call confinedom_user_login_macro (u_t u_r u_gkeyringd_t u_dbus_t u_exec_content)) ++;(call confined_ssh_connect_macro (u_t u_r u_ssh_agent_t)) ++;(call confined_use_basic_commands_macro (u_t u_r)) +-- +2.41.0 + diff --git a/0002-Add-tests-covering-confined-user-policy-generation.patch b/0002-Add-tests-covering-confined-user-policy-generation.patch new file mode 100644 index 0000000..280257b --- /dev/null +++ b/0002-Add-tests-covering-confined-user-policy-generation.patch @@ -0,0 +1,170 @@ +From bf1c8b2491b6f3eca2e519fb18d7d2143acc54fc Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Wed, 20 Dec 2023 14:33:27 +0100 +Subject: [PATCH] Add tests covering confined user policy generation + +Signed-off-by: Vit Mojzis +--- + tests/test_confined_abcdgilmns.cil | 24 ++++++++++++++++++++ + tests/test_confined_cla.cil | 15 +++++++++++++ + tests/test_confined_lb.cil | 12 ++++++++++ + tests/test_confined_lsid.cil | 17 +++++++++++++++ + tests/test_main.py | 35 +++++++++++++++++++++++++----- + 5 files changed, 98 insertions(+), 5 deletions(-) + create mode 100644 tests/test_confined_abcdgilmns.cil + create mode 100644 tests/test_confined_cla.cil + create mode 100644 tests/test_confined_lb.cil + create mode 100644 tests/test_confined_lsid.cil + +diff --git a/tests/test_confined_abcdgilmns.cil b/tests/test_confined_abcdgilmns.cil +new file mode 100644 +index 0000000..5fd619f +--- /dev/null ++++ b/tests/test_confined_abcdgilmns.cil +@@ -0,0 +1,24 @@ ++(boolean my_container_exec_content true) ++(role my_container_r) ++(type my_container_dbus_t) ++(type my_container_gkeyringd_t) ++(type my_container_ssh_agent_t) ++(type my_container_sudo_t) ++(type my_container_sudo_tmp_t) ++(type my_container_t) ++(type my_container_userhelper_t) ++(user my_container_u) ++(userrole my_container_u my_container_r) ++(userlevel my_container_u (s0)) ++(userrange my_container_u ((s0 ) (s0 (c0)))) ++ ++(call confinedom_admin_commands_macro (my_container_t my_container_r my_container_sudo_t)) ++(call confinedom_graphical_login_macro (my_container_t my_container_r my_container_dbus_t)) ++(call confinedom_mozilla_usage_macro (my_container_t my_container_r)) ++(call confinedom_networking_macro (my_container_t my_container_r)) ++(call confinedom_security_advanced_macro (my_container_t my_container_r my_container_sudo_t my_container_userhelper_t)) ++(call confinedom_security_basic_macro (my_container_t my_container_r)) ++(call confinedom_sudo_macro (my_container_t my_container_r my_container_sudo_t my_container_sudo_tmp_t)) ++(call confinedom_user_login_macro (my_container_t my_container_r my_container_gkeyringd_t my_container_dbus_t my_container_exec_content)) ++(call confined_ssh_connect_macro (my_container_t my_container_r my_container_ssh_agent_t)) ++(call confined_use_basic_commands_macro (my_container_t my_container_r)) +\ No newline at end of file +diff --git a/tests/test_confined_cla.cil b/tests/test_confined_cla.cil +new file mode 100644 +index 0000000..a633aaa +--- /dev/null ++++ b/tests/test_confined_cla.cil +@@ -0,0 +1,15 @@ ++(boolean my_container_exec_content true) ++(role my_container_r) ++(type my_container_dbus_t) ++(type my_container_gkeyringd_t) ++(type my_container_ssh_agent_t) ++(type my_container_sudo_t) ++(type my_container_t) ++(user my_container_u) ++(userrole my_container_u my_container_r) ++(userlevel my_container_u (s0)) ++(userrange my_container_u ((s0 ) (s0 (c0)))) ++ ++(call confinedom_admin_commands_macro (my_container_t my_container_r my_container_sudo_t)) ++(call confinedom_user_login_macro (my_container_t my_container_r my_container_gkeyringd_t my_container_dbus_t my_container_exec_content)) ++(call confined_ssh_connect_macro (my_container_t my_container_r my_container_ssh_agent_t)) +\ No newline at end of file +diff --git a/tests/test_confined_lb.cil b/tests/test_confined_lb.cil +new file mode 100644 +index 0000000..3e3c997 +--- /dev/null ++++ b/tests/test_confined_lb.cil +@@ -0,0 +1,12 @@ ++(boolean my_container_exec_content true) ++(role my_container_r) ++(type my_container_dbus_t) ++(type my_container_gkeyringd_t) ++(type my_container_t) ++(user my_container_u) ++(userrole my_container_u my_container_r) ++(userlevel my_container_u (s0)) ++(userrange my_container_u ((s0 ) (s0 (c0)))) ++ ++(call confinedom_user_login_macro (my_container_t my_container_r my_container_gkeyringd_t my_container_dbus_t my_container_exec_content)) ++(call confined_use_basic_commands_macro (my_container_t my_container_r)) +\ No newline at end of file +diff --git a/tests/test_confined_lsid.cil b/tests/test_confined_lsid.cil +new file mode 100644 +index 0000000..8719420 +--- /dev/null ++++ b/tests/test_confined_lsid.cil +@@ -0,0 +1,17 @@ ++(boolean my_container_exec_content true) ++(role my_container_r) ++(type my_container_dbus_t) ++(type my_container_gkeyringd_t) ++(type my_container_sudo_t) ++(type my_container_sudo_tmp_t) ++(type my_container_t) ++(type my_container_userhelper_t) ++(user my_container_u) ++(userrole my_container_u my_container_r) ++(userlevel my_container_u (s0)) ++(userrange my_container_u ((s0 ) (s0 (c0)))) ++ ++(call confinedom_security_advanced_macro (my_container_t my_container_r my_container_sudo_t my_container_userhelper_t)) ++(call confinedom_security_basic_macro (my_container_t my_container_r)) ++(call confinedom_sudo_macro (my_container_t my_container_r my_container_sudo_t my_container_sudo_tmp_t)) ++(call confinedom_user_login_macro (my_container_t my_container_r my_container_gkeyringd_t my_container_dbus_t my_container_exec_content)) +\ No newline at end of file +diff --git a/tests/test_main.py b/tests/test_main.py +index fb6a9ab..0c73861 100644 +--- a/tests/test_main.py ++++ b/tests/test_main.py +@@ -369,7 +369,26 @@ class TestBase(unittest.TestCase): + self.assert_templates(output, ["base_container"]) + self.assert_policy(test_file("test_devices.podman.cil")) + +- def run_udica(self, args): ++ # Confined user tests ++ def test_confined_user(self): ++ """udica confined_user --level s0 --range s0:c0 my_container""" ++ for arg in ["cla", "lb", "lsid", "abcdgilmns"]: ++ output = self.run_udica( ++ [ ++ "udica", ++ "confined_user", ++ "-{}".format(arg), ++ "--level", ++ "s0", ++ "--range", ++ "s0:c0", ++ "my_container", ++ ], ++ True, ++ ) ++ self.assert_policy(test_file("test_confined_{}.cil".format(arg))) ++ ++ def run_udica(self, args, confined=False): + with patch("sys.argv", args): + with patch("sys.stderr.write") as mock_err, patch( + "sys.stdout.write" +@@ -383,10 +402,16 @@ class TestBase(unittest.TestCase): + udica.__main__.main() + mock_err.assert_not_called() + +- self.assertRegex(mock_out.output, "Policy my_container created") +- self.assertRegex( +- mock_out.output, "--security-opt label=type:my_container.process" +- ) ++ if confined: ++ self.assertRegex(mock_out.output, "semodule -i my_container.cil") ++ self.assertRegex( ++ mock_out.output, "semanage login -a -s my_container_u my_container" ++ ) ++ else: ++ self.assertRegex(mock_out.output, "Policy my_container created") ++ self.assertRegex( ++ mock_out.output, "--security-opt label=type:my_container.process" ++ ) + + return mock_out.output + +-- +2.41.0 + diff --git a/udica.spec b/udica.spec index 1a7a9fc..21b9268 100644 --- a/udica.spec +++ b/udica.spec @@ -1,9 +1,11 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.8 -Release: 1%{?dist} +Release: 2%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz -#git format-patch -N 4a64ff7c1b8116a1894e72eee2a19706e970001f -- . ':!.cirrus.yml' ':!.github' +#git format-patch -N v0.2.8 -- . ':!.cirrus.yml' ':!.github' +Patch0001: 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch +Patch0002: 0002-Add-tests-covering-confined-user-policy-generation.patch License: GPL-3.0-or-later BuildArch: noarch Url: https://github.com/containers/udica @@ -38,6 +40,7 @@ inspection of container JSON file. %{__python2} setup.py install --single-version-externally-managed --root=%{buildroot} %endif +install --directory %{buildroot}%{_datadir}/udica/macros install --directory %{buildroot}%{_mandir}/man8 install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 @@ -46,7 +49,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %{_bindir}/udica %dir %{_datadir}/udica %dir %{_datadir}/udica/ansible +%dir %{_datadir}/udica/macros %{_datadir}/udica/ansible/* +%{_datadir}/udica/macros/* %if 0%{?fedora} || 0%{?rhel} > 7 %license LICENSE @@ -59,6 +64,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Thu Dec 21 2023 Vit Mojzis - 0.2.8-2 +- Add option to generate custom policy for a confined user + * Wed Nov 29 2023 Vit Mojzis - 0.2.8-1 - New release From ddb7e251dcf8a16ae09d2d22e266397c1e081ea4 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 06:58:54 +0000 Subject: [PATCH 64/80] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 21b9268..ae5dfe8 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.8 -Release: 2%{?dist} +Release: 3%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N v0.2.8 -- . ':!.cirrus.yml' ':!.github' Patch0001: 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch @@ -64,6 +64,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 0.2.8-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Dec 21 2023 Vit Mojzis - 0.2.8-2 - Add option to generate custom policy for a confined user From 810c5dd87d34d7569f7811df98d4cb8bc23aeef7 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 12 Feb 2024 20:04:04 +0100 Subject: [PATCH 65/80] udica-0.2.8-4 - confined: make "-l" non optional - confined: allow asynchronous I/O operations --- ...nerate-custom-policy-for-a-confined-.patch | 98 ++++++++++++++++--- ...ring-confined-user-policy-generation.patch | 4 +- 0003-confined-make-l-non-optional.patch | 57 +++++++++++ ...ed-allow-asynchronous-I-O-operations.patch | 31 ++++++ udica.spec | 7 +- 5 files changed, 181 insertions(+), 16 deletions(-) create mode 100644 0003-confined-make-l-non-optional.patch create mode 100644 0004-confined-allow-asynchronous-I-O-operations.patch diff --git a/0001-Add-option-to-generate-custom-policy-for-a-confined-.patch b/0001-Add-option-to-generate-custom-policy-for-a-confined-.patch index d18dbbc..a0acf2a 100644 --- a/0001-Add-option-to-generate-custom-policy-for-a-confined-.patch +++ b/0001-Add-option-to-generate-custom-policy-for-a-confined-.patch @@ -1,4 +1,4 @@ -From 21aa1fb602540d26e3ccad46ab59922da1810dd8 Mon Sep 17 00:00:00 2001 +From 3cda61f9a576315e9889821faf495663ad8257ef Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 29 Nov 2023 10:38:48 +0100 Subject: [PATCH] Add option to generate custom policy for a confined user @@ -13,14 +13,76 @@ https://github.com/Koncpa/confined-users-policy Signed-off-by: Vit Mojzis --- + README.md | 50 + setup.py | 1 + - udica/__main__.py | 332 +- + udica/__main__.py | 342 +- udica/confined_user.py | 134 + udica/macros/confined_user_macros.cil | 4367 +++++++++++++++++++++++++ - 4 files changed, 4719 insertions(+), 115 deletions(-) + 5 files changed, 4779 insertions(+), 115 deletions(-) create mode 100644 udica/confined_user.py create mode 100644 udica/macros/confined_user_macros.cil +diff --git a/README.md b/README.md +index b37b885..37f68b1 100644 +--- a/README.md ++++ b/README.md +@@ -170,6 +170,56 @@ SELinux now allows binding to tcp/udp port *21*, but not to *80*: + Ncat: SHA-1 fingerprint: 6EEC 102E 6666 5F96 CC4F E5FA A1BE 4A5E 6C76 B6DC + Ncat: bind to :::80: Permission denied. QUITTING. + ++## Creating SELinux policy for confined user ++ ++Each Linux user on an SELinux-enabled system is mapped to an SELinux user. By default administrators can choose between the following SELinux users when confining a user account: root, staff_u, sysadm_u, user_u, xguest_u, guest_u (and unconfined_u which does not limit the user's actions). ++ ++To give administrators more options in confining users, *udica* now provides a way to generate a custom SELinux user (and corresponding roles and types) based on the specified parameters. The new user policy is assembled using a set of predefined policy macros based on use-cases (managing network, administrative tasks, etc.). ++ ++To generate a confined user, use the "confined_user" keyword followed by a list of options: ++ ++| Option | Use case | ++| ------------- | ------------- | ++| -a, --admin_commands | Use administrative commands (vipw, passwd, ...) | ++| -g, --graphical_login | Use graphical login environment | ++| -m, --mozilla_usage | Use mozilla firefox | ++| -n, --networking | Manage basic networking (ip, ifconfig, traceroute, tcpdump, ...) | ++| -d, --security_advanced | Manage SELinux settings (semanage, semodule, sepolicy, ...) | ++| -i, --security_basic | Use read-only security-related tools (seinfo, getsebool, sesearch, ...) | ++| -s, --sudo | Run commands as root using sudo | ++| -l, --user_login | Basic rules common to all users (tty, pty, ...) | ++| -c, --ssh_connect | Connect over SSH | ++| -b, --basic_commands | Use basic commands (date, ls, ps, man, systemctl -user, journalctl -user, passwd, ...) | ++ ++The new user also needs to be assigned an MLS/MCS level and range. These are set to `s0` and `s0:c0.c1023` respectively by default to work well in *targeted* policy mode. ++For more details see [Red Hat Multi-Level Security documentation](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/using_selinux/index#using-multi-level-security-mls_using-selinux). ++ ++``` ++$ udica confined_user -abcdgilmns --level s0 --range "s0:c0" custom_user ++ ++Created custom_user.cil ++Run the following commands to apply the new policy: ++Install the new policy module ++# semodule -i custom_user.cil /usr/share/udica/macros/confined_user_macros.cil ++Create a default context file for the new user ++# sed -e ’s|user|custom_user|g’ /etc/selinux/targeted/contexts/users/user_u > /etc/selinux/targeted/contexts/users/custom_user_u ++Map the new selinux user to an existing user account ++# semanage login -a -s custom_user_u custom_user ++Fix labels in the user's home directory ++# restorecon -RvF /home/custom_user ++``` ++ ++As prompted by *udica*, the new user policy needs to be installed into the system along with the *confined_user_macros* file and a *default context* file needs to be created before the policy is ready to be used. ++ ++Last step is either assignment to an existing linux user (using `semanage login`), or specifying the new SELinux user when creating a new linux user account (no need to run `restorecon` for a new user home directory). ++``` ++useradd -Z custom_user_u ++``` ++ ++The created policy defines a new SELinux user `_u`, a corresponding role `_r` and a list of types (varies based on selected options) `_t, _sudo_t, _ssh_agent_t, ...` ++ ++See [Red Hat Confined User documentation](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/using_selinux/managing-confined-and-unconfined-users_using-selinux#doc-wrapper) for more details about confined users, their assignment, available roles and access they allow. ++ + ## SELinux labels vs. objects they represent + + Policies generated by *udica* work with **SELinux labels** as opposed to filesystem paths, port numbers etc. This means that allowing access to given path (e.g. path to a directory mounted to your container), port number, or any other resource may also allow access to other resources you didn't specify, since the same SELinux label can be assigned to multiple resources. diff --git a/setup.py b/setup.py index deb6457..d3f20f4 100644 --- a/setup.py @@ -34,7 +96,7 @@ index deb6457..d3f20f4 100644 # scripts=["bin/udica"], entry_points={"console_scripts": ["udica=udica.__main__:main"]}, diff --git a/udica/__main__.py b/udica/__main__.py -index 43d2e43..2bbd401 100644 +index 43d2e43..1ba8515 100644 --- a/udica/__main__.py +++ b/udica/__main__.py @@ -13,8 +13,9 @@ @@ -48,7 +110,7 @@ index 43d2e43..2bbd401 100644 # import udica from udica.parse import parse_avc_file -@@ -25,116 +26,214 @@ from udica.policy import create_policy, load_policy, generate_playbook +@@ -25,116 +26,224 @@ from udica.policy import create_policy, load_policy, generate_playbook def get_args(): @@ -248,9 +310,19 @@ index 43d2e43..2bbd401 100644 + dest="basic_commands", + help="Use basic commands (date, ls, ps, man, systemctl -user, journalctl -user, passwd, ...)", + ) -+ parser.add_argument("--level", nargs="?", default="s0", dest="level") + parser.add_argument( -+ "--range", nargs="?", default="s0-s0:c0.c1023", dest="range" ++ "--level", ++ nargs="?", ++ default="s0", ++ dest="level", ++ help='MLS/MCS level, defaults to "s0"', ++ ) ++ parser.add_argument( ++ "--range", ++ nargs="?", ++ default="s0-s0:c0.c1023", ++ dest="range", ++ help='MLS/MCS range, defaults to "s0-s0:c0.c1023"', + ) + parser.add_argument("uname") + else: @@ -373,7 +445,7 @@ index 43d2e43..2bbd401 100644 args = parser.parse_args() return vars(args) -@@ -142,6 +241,13 @@ def get_args(): +@@ -142,6 +251,13 @@ def get_args(): def main(): opts = get_args() @@ -387,7 +459,7 @@ index 43d2e43..2bbd401 100644 if opts["ContainerID"]: container_inspect_raw = None for backend in [ENGINE_PODMAN, ENGINE_DOCKER]: -@@ -167,8 +273,6 @@ def main(): +@@ -167,8 +283,6 @@ def main(): if opts["JsonFile"]: if opts["JsonFile"] == "-": @@ -396,7 +468,7 @@ index 43d2e43..2bbd401 100644 container_inspect_raw = sys.stdin.read() else: import os.path -@@ -182,8 +286,6 @@ def main(): +@@ -182,8 +296,6 @@ def main(): if (not opts["JsonFile"]) and (not opts["ContainerID"]): try: @@ -407,7 +479,7 @@ index 43d2e43..2bbd401 100644 print("Couldn't parse inspect data from stdin:", e) diff --git a/udica/confined_user.py b/udica/confined_user.py new file mode 100644 -index 0000000..796f543 +index 0000000..bd92378 --- /dev/null +++ b/udica/confined_user.py @@ -0,0 +1,134 @@ @@ -543,7 +615,7 @@ index 0000000..796f543 + ) + print("Map the new selinux user to an existing user account") + print("# semanage login -a -s {}_u {}".format(opts["uname"], opts["uname"])) -+ print("Fix labels in the user's home direcotry") ++ print("Fix labels in the user's home directory") + print("# restorecon -RvF /home/{}".format(opts["uname"])) diff --git a/udica/macros/confined_user_macros.cil b/udica/macros/confined_user_macros.cil new file mode 100644 @@ -4919,5 +4991,5 @@ index 0000000..ddb5689 +;(call confined_ssh_connect_macro (u_t u_r u_ssh_agent_t)) +;(call confined_use_basic_commands_macro (u_t u_r)) -- -2.41.0 +2.43.0 diff --git a/0002-Add-tests-covering-confined-user-policy-generation.patch b/0002-Add-tests-covering-confined-user-policy-generation.patch index 280257b..ef435f5 100644 --- a/0002-Add-tests-covering-confined-user-policy-generation.patch +++ b/0002-Add-tests-covering-confined-user-policy-generation.patch @@ -1,4 +1,4 @@ -From bf1c8b2491b6f3eca2e519fb18d7d2143acc54fc Mon Sep 17 00:00:00 2001 +From d444e67ead27266d57184ab8bc032c5528f7e26c Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 20 Dec 2023 14:33:27 +0100 Subject: [PATCH] Add tests covering confined user policy generation @@ -166,5 +166,5 @@ index fb6a9ab..0c73861 100644 return mock_out.output -- -2.41.0 +2.43.0 diff --git a/0003-confined-make-l-non-optional.patch b/0003-confined-make-l-non-optional.patch new file mode 100644 index 0000000..938a20f --- /dev/null +++ b/0003-confined-make-l-non-optional.patch @@ -0,0 +1,57 @@ +From f411c146986fabe7375724528b2d4ba8cf78b904 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 12 Feb 2024 19:38:14 +0100 +Subject: [PATCH] confined: make "-l" non optional + +The confinedom_user_login_macro is needed for all custom users. + +Also, allow the new user type to be accessed via remote login. + +Signed-off-by: Vit Mojzis +--- + udica/__main__.py | 2 +- + udica/macros/confined_user_macros.cil | 8 +++++++- + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/udica/__main__.py b/udica/__main__.py +index 1ba8515..801499c 100644 +--- a/udica/__main__.py ++++ b/udica/__main__.py +@@ -92,7 +92,7 @@ def get_args(): + "-l", + "--user_login", + action="store_true", +- default=False, ++ default=True, + dest="user_login", + help="Basic rules common to all users (tty, pty, ...)", + ) +diff --git a/udica/macros/confined_user_macros.cil b/udica/macros/confined_user_macros.cil +index ddb5689..06c4c56 100644 +--- a/udica/macros/confined_user_macros.cil ++++ b/udica/macros/confined_user_macros.cil +@@ -2411,7 +2411,7 @@ + (typetransition utype sudo_exec_t process sudo_type) + (allow sudo_type utype (fd (use))) + (allow sudo_type utype (fifo_file (ioctl read write getattr lock append))) +- (allow sudo_type utype (process (sigchld))) ++ (allow sudo_type utype (process (getpgid sigchld))) + (allow sudo_type bin_t (dir (getattr open search))) + (allow sudo_type bin_t (dir (ioctl read getattr lock open search))) + (allow sudo_type bin_t (dir (getattr open search))) +@@ -4006,6 +4006,12 @@ + ) + ) + ) ++ ; Telnet login ++ (optional confinedom_user_login_optional_3 ++ (typeattributeset cil_gen_require remote_login_t) ++ (allow remote_login_t utype (process (signal transition))) ++ (allow utype self (bpf (prog_load))) ++ ) + ) + + (macro confined_ssh_connect_macro ((type utype) (role urole) (type ssh_agent_type)) +-- +2.43.0 + diff --git a/0004-confined-allow-asynchronous-I-O-operations.patch b/0004-confined-allow-asynchronous-I-O-operations.patch new file mode 100644 index 0000000..00241b6 --- /dev/null +++ b/0004-confined-allow-asynchronous-I-O-operations.patch @@ -0,0 +1,31 @@ +From 131d228c6a91eaaeccc1d000821beeccba69d134 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 4 Mar 2024 12:59:53 +0100 +Subject: [PATCH] confined: allow asynchronous I/O operations + +Signed-off-by: Vit Mojzis +--- + udica/macros/confined_user_macros.cil | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/udica/macros/confined_user_macros.cil b/udica/macros/confined_user_macros.cil +index 06c4c56..dcb5198 100644 +--- a/udica/macros/confined_user_macros.cil ++++ b/udica/macros/confined_user_macros.cil +@@ -4012,6 +4012,13 @@ + (allow remote_login_t utype (process (signal transition))) + (allow utype self (bpf (prog_load))) + ) ++ ; asynchronous I/O operations RHEL 10 ++ (optional confinedom_user_login_optional_4 ++ (typeattributeset cil_gen_require io_uring_t) ++ (allow utype self (io_uring (sqpoll))) ++ (allow utype io_uring_t (anon_inode (create))) ++ (allow utype io_uring_t (anon_inode (read write getattr map))) ++ ) + ) + + (macro confined_ssh_connect_macro ((type utype) (role urole) (type ssh_agent_type)) +-- +2.43.0 + diff --git a/udica.spec b/udica.spec index ae5dfe8..42e1cef 100644 --- a/udica.spec +++ b/udica.spec @@ -1,11 +1,13 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.8 -Release: 3%{?dist} +Release: 4%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N v0.2.8 -- . ':!.cirrus.yml' ':!.github' Patch0001: 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch Patch0002: 0002-Add-tests-covering-confined-user-policy-generation.patch +Patch0003: 0003-confined-make-l-non-optional.patch +Patch0004: 0004-confined-allow-asynchronous-I-O-operations.patch License: GPL-3.0-or-later BuildArch: noarch Url: https://github.com/containers/udica @@ -64,6 +66,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Feb 12 2024 Vit Mojzis - 0.2.8-4 +- confined: make "-l" non optional + * Sat Jan 27 2024 Fedora Release Engineering - 0.2.8-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 1702ce63fc6284f2ce0ab4def88b0fa40b7962ea Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 19 Dec 2023 00:37:40 +0100 Subject: [PATCH 66/80] Udica confined_user tests Signed-off-by: Vit Mojzis --- tests/confined/Makefile | 68 +++++++++++++++++++++++++++++++++ tests/confined/a.sh | 13 +++++++ tests/confined/b.sh | 17 +++++++++ tests/confined/d.sh | 12 ++++++ tests/confined/i.sh | 11 ++++++ tests/confined/l.sh | 2 + tests/confined/main.fmf | 34 +++++++++++++++++ tests/confined/n.sh | 15 ++++++++ tests/confined/s.sh | 9 +++++ tests/confined/ssh.exp | 23 ++++++++++++ tests/confined/telnet.exp | 24 ++++++++++++ tests/confined/test.sh | 79 +++++++++++++++++++++++++++++++++++++++ 12 files changed, 307 insertions(+) create mode 100644 tests/confined/Makefile create mode 100755 tests/confined/a.sh create mode 100755 tests/confined/b.sh create mode 100755 tests/confined/d.sh create mode 100755 tests/confined/i.sh create mode 100755 tests/confined/l.sh create mode 100644 tests/confined/main.fmf create mode 100755 tests/confined/n.sh create mode 100755 tests/confined/s.sh create mode 100755 tests/confined/ssh.exp create mode 100755 tests/confined/telnet.exp create mode 100755 tests/confined/test.sh diff --git a/tests/confined/Makefile b/tests/confined/Makefile new file mode 100644 index 0000000..0a04b5c --- /dev/null +++ b/tests/confined/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /pkgs.fedoraproject.org/rpms/udica/tests/confined +# Description: Test basic use cases of confined user policies generated by udica +# Authors: Milos Malik , Vit Mojzis +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2015 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/udica/confined +export TESTVERSION=1.0 + +BUILT_FILES= + +SCRIPTS=a.sh b.sh d.sh i.sh l.sh n.sh s.sh + +FILES=$(METADATA) test.sh Makefile $(SCRIPTS) ssh.exp telnet.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./test.sh + +build: $(BUILT_FILES) + chmod a+x test.sh ssh.exp telnet.exp $(SCRIPTS) + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Vit Mojzis " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test basic use cases of confined user policies generated by udica" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 60m" >> $(METADATA) + @echo "RunFor: udica" >> $(METADATA) + @echo "Requires: udica expect" >> $(METADATA) + @echo "Requires: /usr/sbin/semanage" >> $(METADATA) + @echo "Requires: traceroute tcpdump setools-console policycoreutils-devel bind-utils" >> $(METADATA) + @echo "Requires: grep telnet telnet-server net-tools" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/tests/confined/a.sh b/tests/confined/a.sh new file mode 100755 index 0000000..14cacfb --- /dev/null +++ b/tests/confined/a.sh @@ -0,0 +1,13 @@ +#!/bin/sh -x +on_err(){ + echo "Error" +} + +trap 'on_err' ERR + +# gets stuck -- no journal entries +#sudo journalctl -n 1 --no-pager +sudo systemctl --no-pager status dbus +sudo netstat -g +sudo nslookup www.google.com +sudo sysctl net.ipv4.udp_mem diff --git a/tests/confined/b.sh b/tests/confined/b.sh new file mode 100755 index 0000000..57ab006 --- /dev/null +++ b/tests/confined/b.sh @@ -0,0 +1,17 @@ +#!/bin/sh -x +on_err(){ + echo "Error" +} + +trap 'on_err' ERR + +id -Z +date +ls ~ +ps +man -f selinux +systemctl --no-pager --user status dbus | grep "D-Bus User Message Bus" +journalctl -user +# cannot rotate the orgiginal password as user +#echo -e "$1\n9$1\n9$1" | passwd +#echo -e "9$1\n$1\n$1" | passwd diff --git a/tests/confined/d.sh b/tests/confined/d.sh new file mode 100755 index 0000000..c65867b --- /dev/null +++ b/tests/confined/d.sh @@ -0,0 +1,12 @@ +#!/bin/sh -x +on_err(){ + echo "Error" +} + +trap 'on_err' ERR + +sesearch -A -s httpd_t -t http_port_t -c tcp_socket +sudo semanage user -l +sudo semanage fcontext -lC +sudo semodule -B +sudo sepolicy network -p 44322 diff --git a/tests/confined/i.sh b/tests/confined/i.sh new file mode 100755 index 0000000..e403087 --- /dev/null +++ b/tests/confined/i.sh @@ -0,0 +1,11 @@ +#!/bin/sh -x +on_err(){ + echo "Error" +} + +trap 'on_err' ERR + + +seinfo +getsebool httpd_can_connect_ftp +sesearch -A -s httpd_t -t http_port_t -c tcp_socket diff --git a/tests/confined/l.sh b/tests/confined/l.sh new file mode 100755 index 0000000..e305e58 --- /dev/null +++ b/tests/confined/l.sh @@ -0,0 +1,2 @@ +#!/bin/sh -x +id -Z diff --git a/tests/confined/main.fmf b/tests/confined/main.fmf new file mode 100644 index 0000000..01470d1 --- /dev/null +++ b/tests/confined/main.fmf @@ -0,0 +1,34 @@ +summary: Concise summary describing what the test does +description: |+ + Test basic functionality of sepolicy_confine tool + +contact: Vit Mojzis +component: + - policycoreutils + +test: ./test.sh +framework: beakerlib +recommend: + - policycoreutils + - /usr/sbin/semanage + - expect + - net-tools + - traceroute + - tcpdump + - setools-console + - policycoreutils-devel + - bind-utils + - grep + - telnet + - telnet-server + +duration: 60m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false diff --git a/tests/confined/n.sh b/tests/confined/n.sh new file mode 100755 index 0000000..f5bbb4c --- /dev/null +++ b/tests/confined/n.sh @@ -0,0 +1,15 @@ +#!/bin/sh -x +on_err(){ + echo "Error" +} + +trap 'on_err' ERR + +ip address +ifconfig -s +traceroute 127.0.0.1 +# this may block the test if there is no trafic !!! +sudo tcpdump -i any -c 1 +netstat -g +nslookup www.google.com +ping -c 1 127.0.0.1 diff --git a/tests/confined/s.sh b/tests/confined/s.sh new file mode 100755 index 0000000..a0dc442 --- /dev/null +++ b/tests/confined/s.sh @@ -0,0 +1,9 @@ +#!/bin/sh -x +on_err(){ + echo "Error" +} + +trap 'on_err' ERR + +sudo id -Z +sudo passwd -S root diff --git a/tests/confined/ssh.exp b/tests/confined/ssh.exp new file mode 100755 index 0000000..1d90f5a --- /dev/null +++ b/tests/confined/ssh.exp @@ -0,0 +1,23 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 300 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +#expect { +# "[sudo] password" {send -- "$password" ; exp_continue } +#} + +log_user 1 +# send -- "\r" +expect eof diff --git a/tests/confined/telnet.exp b/tests/confined/telnet.exp new file mode 100755 index 0000000..18a3842 --- /dev/null +++ b/tests/confined/telnet.exp @@ -0,0 +1,24 @@ +#!/usr/bin/expect -f +# Expect script for telnet logging as $username to $hostname using $password and executing $command. +# Usage: +# ./telnet.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +#set timeout 300 +# connect to remote host and execute given command +log_user 1 +spawn telnet $hostname 23 + +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" ; exp_continue } + -nocase "kernel" { send -- "$username\r" ; exp_continue } + -nocase "last login" { send -- "$command\r" } +} + +log_user 1 +send -- "\r" +sleep 1 +expect eof diff --git a/tests/confined/test.sh b/tests/confined/test.sh new file mode 100755 index 0000000..548efa5 --- /dev/null +++ b/tests/confined/test.sh @@ -0,0 +1,79 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +POLICY_OPTIONS=${POLICY_OPTIONS:-"lbc clbsa lbsidca lbscid lbsidc agmndislcb"} +TEST_SCRIPTS="abdilns" +#SEPOLICY_CONFINE="confined-users-policy/sepolicy_confine/sepolicy_confine" +SEPOLICY_CONFINE="udica confined_user" + +rlJournalStart + rlPhaseStartSetup + rlRun "set -o pipefail" + rlRun "systemctl start telnet.socket" + rlSEConfigureSSH + rlRun "semodule -i /usr/share/udica/macros/confined_user_macros.cil" + rlRun "setsebool ssh_sysadm_login on" + # do not show "With great power comes great responsibility." prompt + # and don't ask for password when using "sudo" + echo "%users ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers.d/confined_users_test; + echo "%wheel ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers.d/confined_users_test; + echo 'Defaults lecture="never"' >> /etc/sudoers.d/confined_users_test; + rlPhaseEnd + + #TODO try different level and range for the generated user policy + rlPhaseStartTest "real scenario -- confined users" + USER_NAME_SEED="user${RANDOM}" + USER_NAME_INDEX=1 + USER_LIST="" + for OPTIONS in ${POLICY_OPTIONS} ; do + USER_NAME="${USER_NAME_SEED}$((USER_NAME_INDEX++))" + USER_LIST+=" ${USER_NAME}" + USER_SECRET="S3kr3t${RANDOM}" + SELINUX_USER="confined_${OPTIONS}" + rlLog "Testing SELinux users: ${SELINUX_USER}" + rlRun "${SEPOLICY_CONFINE} -${OPTIONS} --level s0 --range s0-s0:c0.c1023 ${SELINUX_USER}" + rlRun "semodule -i ${SELINUX_USER}.cil" + rlRun "sed -e 's|user|${SELINUX_USER}|g' /etc/selinux/targeted/contexts/users/user_u > /etc/selinux/targeted/contexts/users/${SELINUX_USER}_u" + rlRun "useradd -Z ${SELINUX_USER}_u ${USER_NAME}" + rlRun "cp *.sh /home/${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "usermod -G wheel ${USER_NAME}" + # dummy -- first telnet connection does not show results properly + rlRun "./telnet.exp ${USER_NAME} ${USER_SECRET} localhost whoami" + # run all available scripts matching given confined user options + TO_RUN=${OPTIONS//[^"$TEST_SCRIPTS"]} + for (( i=0; i<${#TO_RUN}; i++ )) ; do + rlRun -s "./telnet.exp ${USER_NAME} ${USER_SECRET} localhost /home/${USER_NAME}/${TO_RUN:$i:1}.sh ${USER_SECRET}" + echo "\n" + rlRun "grep -e 'Error' $rlRun_LOG" 1 + done + # run test scripts over SSH if the new user is allowed to use it + if [[ "$OPTIONS" == *"c"* ]]; then + for (( i=0; i<${#TO_RUN}; i++ )) ; do + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /home/${USER_NAME}/${TO_RUN:$i:1}.sh ${USER_SECRET}" + rlRun "grep -e 'Error' $rlRun_LOG" 1 + done + fi + sleep 10 + done + # remove all test users + for USER_NAME in ${USER_LIST} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done + sleep 10 + # remove test SELinux users + for OPTIONS in ${POLICY_OPTIONS} ; do + rlRun "rm -rf confined_${OPTIONS}.cil /etc/selinux/targeted/contexts/users/confined_${OPTIONS}_u" + rlRun "semodule -r confined_${OPTIONS}" + done + rlRun "rm -rf $rlRun_LOG" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semodule -r confined_user_macros" + rlRun "rm -rf /etc/sudoers.d/confined_users_test" + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd +rlJournalEnd From f6cea24f4dbc23064a34b1c92d15390d5d338d82 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 26 Mar 2024 09:58:59 +0100 Subject: [PATCH 67/80] tests/confined: Initialize metadata tree Needed to run the test using fmf automation. --- tests/confined/.fmf/version | 1 + 1 file changed, 1 insertion(+) create mode 100644 tests/confined/.fmf/version diff --git a/tests/confined/.fmf/version b/tests/confined/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/tests/confined/.fmf/version @@ -0,0 +1 @@ +1 From 241fdf3a8ad519b712ae52b4945fff89b88f0b19 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 26 Mar 2024 09:58:59 +0100 Subject: [PATCH 68/80] tests: Initialize metadata tree Needed to run tests using fmf automation. Move the version file introduced by "f6cea24f4 tests/confined: Initialize metadata tree" into the top-level directory. --- {tests/confined/.fmf => .fmf}/version | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename {tests/confined/.fmf => .fmf}/version (100%) diff --git a/tests/confined/.fmf/version b/.fmf/version similarity index 100% rename from tests/confined/.fmf/version rename to .fmf/version From 2421f40c3b4e2648a4d4f82dd9b9f3d8a473e6a3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 2 Apr 2024 10:39:40 +0200 Subject: [PATCH 69/80] run the existing tests via TMT/FMF Use the TMT/FMF instead of STI for running tests. STI does not respect the adjust section in main.fmf files of stored tests. Add missing main.fmf files to tests which are not TMT/FMF enabled. --- plans/tests.fmf | 6 ++++++ tests/confined/test.sh | 12 +++++++++++- tests/docker/main.fmf | 27 +++++++++++++++++++++++++++ tests/docker/runtest.sh | 3 +-- tests/sanity/main.fmf | 26 ++++++++++++++++++++++++++ tests/sanity/runtest.sh | 1 - 6 files changed, 71 insertions(+), 4 deletions(-) create mode 100644 plans/tests.fmf create mode 100644 tests/docker/main.fmf create mode 100644 tests/sanity/main.fmf diff --git a/plans/tests.fmf b/plans/tests.fmf new file mode 100644 index 0000000..5caa44e --- /dev/null +++ b/plans/tests.fmf @@ -0,0 +1,6 @@ +summary: basic udica test plan +discover: + how: fmf +execute: + how: tmt + diff --git a/tests/confined/test.sh b/tests/confined/test.sh index 548efa5..fdc065a 100755 --- a/tests/confined/test.sh +++ b/tests/confined/test.sh @@ -12,7 +12,12 @@ rlJournalStart rlPhaseStartSetup rlRun "set -o pipefail" rlRun "systemctl start telnet.socket" - rlSEConfigureSSH + + if [ -d /etc/ssh/sshd_config.d ] ; then + rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf" + rlRun "service sshd restart" + fi + rlRun "semodule -i /usr/share/udica/macros/confined_user_macros.cil" rlRun "setsebool ssh_sysadm_login on" # do not show "With great power comes great responsibility." prompt @@ -75,5 +80,10 @@ rlJournalStart rlRun "semodule -r confined_user_macros" rlRun "rm -rf /etc/sudoers.d/confined_users_test" rlRun "setsebool ssh_sysadm_login off" + + if [ -d /etc/ssh/sshd_config.d ] ; then + rlRun "rm -f /etc/ssh/sshd_config.d/001-enable-password.conf" + rlRun "service sshd restart" + fi rlPhaseEnd rlJournalEnd diff --git a/tests/docker/main.fmf b/tests/docker/main.fmf new file mode 100644 index 0000000..1ea109a --- /dev/null +++ b/tests/docker/main.fmf @@ -0,0 +1,27 @@ +summary: Compare udica output between podman and docker +description: |+ + Compare udica output between podman and docker + +contact: Jan Zarsky +component: + - udica +test: ./runtest.sh +framework: beakerlib +recommend: + - container-selinux + - /usr/bin/docker + - podman + - policycoreutils + - udica +duration: 20m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the udica package is not available there diff --git a/tests/docker/runtest.sh b/tests/docker/runtest.sh index 1850b3c..8377307 100755 --- a/tests/docker/runtest.sh +++ b/tests/docker/runtest.sh @@ -25,7 +25,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="udica" @@ -36,7 +35,7 @@ rlJournalStart rlAssertRpm "container-selinux" rlAssertRpm "policycoreutils" rlAssertRpm "podman" - rlAssertRpm "docker" + rlRun "rpm -qf /usr/bin/docker" rlRun "rlServiceStart docker" OUTPUT_FILE=$(mktemp) rlPhaseEnd diff --git a/tests/sanity/main.fmf b/tests/sanity/main.fmf new file mode 100644 index 0000000..9bad64b --- /dev/null +++ b/tests/sanity/main.fmf @@ -0,0 +1,26 @@ +summary: Test basic functionality of udica +description: |+ + Test basic functionality of udica + +contact: Jan Zarsky +component: + - udica +test: ./runtest.sh +framework: beakerlib +recommend: + - container-selinux + - podman + - policycoreutils + - udica +duration: 20m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the udica package is not available there diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh index 260add0..fe9a90a 100755 --- a/tests/sanity/runtest.sh +++ b/tests/sanity/runtest.sh @@ -25,7 +25,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="udica" From 9d53f174059a1c21c0da43597a88c76d395f363a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 25 Apr 2024 16:17:20 +0200 Subject: [PATCH 70/80] ensure the udica package is installed before test run The automated test uses the following file which is shipped in the udica package: * /usr/share/udica/macros/confined_user_macros.cil Unfortunately, the udica package was not listed in the main.fmf file as recommended or required. The problem should be fixed now. --- tests/confined/main.fmf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/confined/main.fmf b/tests/confined/main.fmf index 01470d1..9119eba 100644 --- a/tests/confined/main.fmf +++ b/tests/confined/main.fmf @@ -5,7 +5,7 @@ description: |+ contact: Vit Mojzis component: - policycoreutils - + - udica test: ./test.sh framework: beakerlib recommend: @@ -21,7 +21,7 @@ recommend: - grep - telnet - telnet-server - + - udica duration: 60m enabled: true tag: From 91734a3b335b36b52650767345a5e76bb03efb36 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 7 Jun 2024 09:12:10 +0200 Subject: [PATCH 71/80] Rebuilt for Python 3.13 --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 42e1cef..86b32c2 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.8 -Release: 4%{?dist} +Release: 5%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N v0.2.8 -- . ':!.cirrus.yml' ':!.github' Patch0001: 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch @@ -66,6 +66,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Fri Jun 07 2024 Python Maint - 0.2.8-5 +- Rebuilt for Python 3.13 + * Mon Feb 12 2024 Vit Mojzis - 0.2.8-4 - confined: make "-l" non optional From a4553748a3c43d4821e0f1c9b2f6ade899879746 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 08:08:01 +0000 Subject: [PATCH 72/80] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 86b32c2..6439aa8 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.8 -Release: 5%{?dist} +Release: 6%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N v0.2.8 -- . ':!.cirrus.yml' ':!.github' Patch0001: 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch @@ -66,6 +66,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 0.2.8-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Fri Jun 07 2024 Python Maint - 0.2.8-5 - Rebuilt for Python 3.13 From 46f7cd3660f60f50b8c66b6f69869ed8af33a6ee Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 13:36:41 +0000 Subject: [PATCH 73/80] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 6439aa8..ded7662 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.8 -Release: 6%{?dist} +Release: 7%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N v0.2.8 -- . ':!.cirrus.yml' ':!.github' Patch0001: 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch @@ -66,6 +66,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 0.2.8-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sat Jul 20 2024 Fedora Release Engineering - 0.2.8-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From c97d161804af44904f1680a6b9ee256480235042 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 11 Oct 2024 11:12:19 +0200 Subject: [PATCH 74/80] pyprojectize spec file The old %py3_build and %py3_install macros (201x-era) as documented in [1] use a deprecated feature of setuptools. It is highly recommended to use the current %pyproject macros instead as documented in [2] and [3] sooner than it becomes necessary. [1]: https://docs.fedoraproject.org/en-US/packaging-guidelines/Python_201x/ [2]: https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/ [3]: https://src.fedoraproject.org/rpms/pyproject-rpm-macros/blob/rawhide/f/README.md https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/RFHSXAU2D4PEN2KHZCBUGP6MEGTUOUD2/ --- ...hs-it-s-undefined-behavior-with-abso.patch | 30 +++++++++++++++++++ udica.spec | 27 +++++------------ 2 files changed, 38 insertions(+), 19 deletions(-) create mode 100644 0005-use-relative-paths-it-s-undefined-behavior-with-abso.patch diff --git a/0005-use-relative-paths-it-s-undefined-behavior-with-abso.patch b/0005-use-relative-paths-it-s-undefined-behavior-with-abso.patch new file mode 100644 index 0000000..38eb7f4 --- /dev/null +++ b/0005-use-relative-paths-it-s-undefined-behavior-with-abso.patch @@ -0,0 +1,30 @@ +From a9440c7de24e39084bc5f5970bd22eaf224a237f Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Fri, 11 Oct 2024 14:18:07 +0200 +Subject: [PATCH] use relative paths, it's undefined behavior with absolute +Content-type: text/plain + +--- + setup.py | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/setup.py b/setup.py +index d3f20f49bdb0..7a29a6f57d8c 100644 +--- a/setup.py ++++ b/setup.py +@@ -35,9 +35,9 @@ setuptools.setup( + packages=["udica"], + python_requires=">=3.4, <4", + data_files=[ +- ("/usr/share/licenses/udica", ["LICENSE"]), +- ("/usr/share/udica/ansible", ["udica/ansible/deploy-module.yml"]), +- ("/usr/share/udica/macros", ["udica/macros/confined_user_macros.cil"]), ++ ("share/licenses/udica", ["LICENSE"]), ++ ("share/udica/ansible", ["udica/ansible/deploy-module.yml"]), ++ ("share/udica/macros", ["udica/macros/confined_user_macros.cil"]), + ], + # scripts=["bin/udica"], + entry_points={"console_scripts": ["udica=udica.__main__:main"]}, +-- +2.47.0 + diff --git a/udica.spec b/udica.spec index ded7662..a042d07 100644 --- a/udica.spec +++ b/udica.spec @@ -8,11 +8,12 @@ Patch0001: 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch Patch0002: 0002-Add-tests-covering-confined-user-policy-generation.patch Patch0003: 0003-confined-make-l-non-optional.patch Patch0004: 0004-confined-allow-asynchronous-I-O-operations.patch +Patch0005: 0005-use-relative-paths-it-s-undefined-behavior-with-abso.patch License: GPL-3.0-or-later BuildArch: noarch Url: https://github.com/containers/udica %if 0%{?fedora} || 0%{?rhel} > 7 -BuildRequires: python3 python3-devel python3-setuptools +BuildRequires: python3 python3-devel Requires: python3 python3-libsemanage python3-libselinux %else BuildRequires: python2 python2-devel python2-setuptools @@ -28,19 +29,14 @@ inspection of container JSON file. %prep %autosetup -p 1 +%generate_buildrequires +%pyproject_buildrequires + %build -%if 0%{?fedora} || 0%{?rhel} > 7 -%{__python3} setup.py build -%else -%{__python2} setup.py build -%endif +%pyproject_wheel %install -%if 0%{?fedora} || 0%{?rhel} > 7 -%{__python3} setup.py install --single-version-externally-managed --root=%{buildroot} -%else -%{__python2} setup.py install --single-version-externally-managed --root=%{buildroot} -%endif +%pyproject_install install --directory %{buildroot}%{_datadir}/udica/macros install --directory %{buildroot}%{_mandir}/man8 @@ -54,16 +50,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %dir %{_datadir}/udica/macros %{_datadir}/udica/ansible/* %{_datadir}/udica/macros/* - -%if 0%{?fedora} || 0%{?rhel} > 7 %license LICENSE %{python3_sitelib}/udica/ -%{python3_sitelib}/udica-*.egg-info -%else -%{_datarootdir}/licenses/udica/LICENSE -%{python2_sitelib}/udica/ -%{python2_sitelib}/udica-*.egg-info -%endif +%{python3_sitelib}/udica-*.dist-info %changelog * Sun Jan 19 2025 Fedora Release Engineering - 0.2.8-7 From 0280f3893530270bb2c9ae4013ae8cbff434acf9 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 7 Mar 2025 15:21:31 +0100 Subject: [PATCH 75/80] update the list of tested containers The following error message appears when some of the containers are tested: * Could not resolve host: mirrorlist.centos.org; Unknown error Here is the list of containers which reveal the problem: * centos:stream8 * centos:7 From now on, the list of tested containers does not contain them. --- tests/sanity/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh index fe9a90a..75ed634 100755 --- a/tests/sanity/runtest.sh +++ b/tests/sanity/runtest.sh @@ -29,7 +29,7 @@ PACKAGE="udica" -CONTAINERS="fedora:latest fedora:rawhide ubi8 ubi7 centos:stream8 centos:7" +CONTAINERS="fedora:latest fedora:rawhide ubi9 ubi8 ubi7 centos:stream9" rlJournalStart rlPhaseStartSetup From 15036e2280b7633c0e785c55fa7fe9960028f615 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 2 Jun 2025 20:53:40 +0200 Subject: [PATCH 76/80] Rebuilt for Python 3.14 --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index a042d07..8f229de 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.8 -Release: 7%{?dist} +Release: 8%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N v0.2.8 -- . ':!.cirrus.yml' ':!.github' Patch0001: 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch @@ -55,6 +55,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %{python3_sitelib}/udica-*.dist-info %changelog +* Mon Jun 02 2025 Python Maint - 0.2.8-8 +- Rebuilt for Python 3.14 + * Sun Jan 19 2025 Fedora Release Engineering - 0.2.8-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From ca33861f5ed2fc9a0a8a0eb9b2d37da8bfa9baf6 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 19:42:41 +0000 Subject: [PATCH 77/80] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 8f229de..02275eb 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.8 -Release: 8%{?dist} +Release: 9%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N v0.2.8 -- . ':!.cirrus.yml' ':!.github' Patch0001: 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch @@ -55,6 +55,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %{python3_sitelib}/udica-*.dist-info %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 0.2.8-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Mon Jun 02 2025 Python Maint - 0.2.8-8 - Rebuilt for Python 3.14 From a698b129e8b10a09ba788a3bf729452bb5297808 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 15 Aug 2025 15:21:11 +0200 Subject: [PATCH 78/80] Rebuilt for Python 3.14.0rc2 bytecode --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index 02275eb..b4a50de 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.8 -Release: 9%{?dist} +Release: 10%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N v0.2.8 -- . ':!.cirrus.yml' ':!.github' Patch0001: 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch @@ -55,6 +55,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %{python3_sitelib}/udica-*.dist-info %changelog +* Fri Aug 15 2025 Python Maint - 0.2.8-10 +- Rebuilt for Python 3.14.0rc2 bytecode + * Fri Jul 25 2025 Fedora Release Engineering - 0.2.8-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 0d4aedc83ebbc96024383853d21110c4022a7188 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 25 Aug 2025 19:32:04 +0200 Subject: [PATCH 79/80] tests: Convert remaining STI tests to TMT Sanity tests were already converted. https://fedoraproject.org/wiki/Changes/DisableSTI Note: udica-*[0-9]/ was needed because the source directory contained 2 udica folders: udica-0.2.8, udica-0.2.8-SPECPARTS Fixes: https://issues.redhat.com/browse/FC-1894 --- plans/smoke.fmf | 18 ++++++++++++++++++ tests/tests.yml | 34 ---------------------------------- 2 files changed, 18 insertions(+), 34 deletions(-) create mode 100644 plans/smoke.fmf delete mode 100644 tests/tests.yml diff --git a/plans/smoke.fmf b/plans/smoke.fmf new file mode 100644 index 0000000..22eb130 --- /dev/null +++ b/plans/smoke.fmf @@ -0,0 +1,18 @@ +discover: + - how: shell + dist-git-source: true + tests: + - name: /smoke + test: cd $TMT_SOURCE_DIR/udica-*[0-9]/ && python3 -m unittest -v tests/test_unit.py + - name: /smoke2 + test: cd $TMT_SOURCE_DIR/udica-*[0-9]/ && python3 tests/test_integration.py +prepare: + - name: install packages + how: install + package: + - udica + - python3 + - container-selinux + - git-core +execute: + how: tmt diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index e8388b7..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,34 +0,0 @@ -- hosts: localhost - tags: - - classic - - container - roles: - - role: standard-test-source - - - role: standard-test-basic - required_packages: - - python3 - - container-selinux - - git - tests: - - smoke: - dir: ./source - run: python3 -m unittest -v tests/test_unit.py - - smoke2: - dir: ./source - run: python3 tests/test_integration.py - -- hosts: localhost - tags: - - classic - - container - roles: - - role: standard-test-beakerlib - tags: - - classic - tests: - - sanity - required_packages: - - podman - - udica - - container-selinux From cd91f1ad1bfc9c47da594f9f72e747b48e0e458e Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 19 Sep 2025 15:00:53 +0200 Subject: [PATCH 80/80] Rebuilt for Python 3.14.0rc3 bytecode --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index b4a50de..37f6fcb 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.8 -Release: 10%{?dist} +Release: 11%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz #git format-patch -N v0.2.8 -- . ':!.cirrus.yml' ':!.github' Patch0001: 0001-Add-option-to-generate-custom-policy-for-a-confined-.patch @@ -55,6 +55,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %{python3_sitelib}/udica-*.dist-info %changelog +* Fri Sep 19 2025 Python Maint - 0.2.8-11 +- Rebuilt for Python 3.14.0rc3 bytecode + * Fri Aug 15 2025 Python Maint - 0.2.8-10 - Rebuilt for Python 3.14.0rc2 bytecode