Update to 4.0.27

- sort permissions alphabetically
- replace search_dir_perms and read_file_perms by list_dir_perms
  (equivalent)

.gitignore

@@ -67,3 +67,4 @@ zabbix-1.8.2.tar.gz
 /zabbix-4.0.16.tar.gz
 /zabbix-4.0.19.tar.gz
 /zabbix-4.0.22.tar.gz
+/zabbix-4.0.27.tar.gz

sources

@@ -1 +1 @@
-SHA512 (zabbix-4.0.22.tar.gz) = de6176c8f833e76da86c6a16558fa7b94fd40d87b4a2525dc91f60490ea226751bf93829f2ec2da87804ab0468c9f76e4b4e9ee7f4e620c87115a5bd9a654f53
+SHA512 (zabbix-4.0.27.tar.gz) = 54690dd778d09d7309c2e2ea3f0bfc6053ef097888bfccd140484e4677766ded829757eb4dfde7da8ce19335307ddbfbb1c132feabc13cc6727a6d28c1591cfa

zabbix.spec

@@ -12,7 +12,7 @@
 
 Name:           zabbix
 Epoch:          1
-Version:        4.0.22
+Version:        4.0.27
 Release:        1%{?dist}
 Summary:        Open-source monitoring solution for your IT infrastructure
 
@@ -293,6 +293,7 @@ rm -rf src/zabbix_java/lib/*.jar
 rm -rf bin
 
 # Override creation of statically named directory for alertscripts and externalscripts
+# and ssl certs/keys
 # https://support.zabbix.com/browse/ZBX-6159
 sed -i '/CURL_SSL_.*_LOCATION\|SCRIPTS_PATH/s|\${datadir}/zabbix|/var/lib/zabbixsrv|' \
     configure
@@ -320,7 +321,7 @@ sed -i \
     -e 's|^# DBSocket=/tmp/mysql.sock|# DBSocket=%{_sharedstatedir}/mysql/mysql.sock|' \
     -e '\|^# ExternalScripts=|a ExternalScripts=%{_sharedstatedir}/zabbixsrv/externalscripts' \
     -e '\|^# AlertScripts=|a AlertScripts=%{_sharedstatedir}/zabbixsrv/alertscripts' \
-    -e '\|^# TmpDir=\/tmp|a TmpDir=%{_sharedstatedir}/zabbixsrv/tmp' \
+    -e '\|^# TmpDir=|a TmpDir=%{_sharedstatedir}/zabbixsrv/tmp' \
     -e 's|/usr/local||' \
     -e 's|\${datadir}|/usr/share|' \
     conf/zabbix_agentd.conf conf/zabbix_proxy.conf conf/zabbix_server.conf
@@ -761,6 +762,9 @@ fi
 %files web-pgsql
 
 %changelog
+* Sun Jan 24 2021 Orion Poplawski <orion@nwra.com> - 1:4.0.27-1
+- Update to 4.0.27
+
 * Sat Jul 18 17:11:45 GMT 2020 Orion Poplawski <orion@nwra.com> - 1:4.0.22-1
 - Update to 4.0.22 (bz#1858259) CVE-2020-15803
 - Fix alert/external scripts directories

zabbix.te

@@ -72,8 +72,8 @@ role system_r types zabbix_script_t;
 # zabbix domain local policy
 #
 
-allow zabbix_domain self:capability { setuid setgid };
-allow zabbix_domain self:process { setpgid setsched getsched signal_perms };
+allow zabbix_domain self:capability { setgid setuid };
+allow zabbix_domain self:process { getsched setpgid setsched signal_perms };
 allow zabbix_domain self:fifo_file rw_fifo_file_perms;
 allow zabbix_domain self:sem create_sem_perms;
 allow zabbix_domain self:shm create_shm_perms;
@@ -157,7 +157,7 @@ tunable_policy(`zabbix_can_network',`
 ')
 
 tunable_policy(`zabbix_run_sudo',`
-    allow zabbix_t self:capability { setuid setgid sys_resource };
+    allow zabbix_t self:capability { setgid setuid sys_resource };
     allow zabbix_t self:process { setrlimit setsched };
     allow zabbix_t self:key write;
     allow zabbix_t self:passwd { passwd rootok };
@@ -285,7 +285,7 @@ zabbix_tcp_connect(zabbix_agent_t)
 zabbix_script_domtrans(zabbix_agent_t)
 
 tunable_policy(`zabbix_run_sudo',`
-    allow zabbix_agent_t self:capability { setuid setgid sys_resource };
+    allow zabbix_agent_t self:capability { setgid setuid sys_resource };
     allow zabbix_agent_t self:process { setrlimit setsched };
     allow zabbix_agent_t self:key write;
     allow zabbix_agent_t self:passwd { passwd rootok };
@@ -324,8 +324,7 @@ optional_policy(`
 
 domtrans_pattern(zabbix_t, zabbix_script_exec_t, zabbix_script_t)
 
-allow zabbix_t zabbix_script_exec_t:dir search_dir_perms;
-allow zabbix_t zabbix_script_exec_t:dir read_file_perms;
+allow zabbix_t zabbix_script_exec_t:dir list_dir_perms;
 allow zabbix_t zabbix_script_exec_t:file ioctl;
 allow zabbix_t zabbix_script_t:process signal;