Merge pull request #417 from stephensmalley/stable6-oxt734

STABLE-6: refpolicy: fix OTA-related denials
OpenXT · Sep 7, 2016 · 871d0d5 · 871d0d5
2 parents 650cd8e + 88a0727
commit 871d0d5
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 3 deletions.
diff --git a/recipes-security/refpolicy/refpolicy-mcs-2.20141203/policy/modules/services/updatemgr.te b/recipes-security/refpolicy/refpolicy-mcs-2.20141203/policy/modules/services/updatemgr.te
@@ -82,3 +82,5 @@ allow updatemgr_t updatemgr_sync_client_storage_t:file manage_file_perms;
 allow updatemgr_t updatemgr_tmp_t:file manage_file_perms;
 allow updatemgr_t self:capability { dac_override chown fowner fsetid };
 
+kernel_request_load_module(updatemgr_t)
+
diff --git a/recipes-security/refpolicy/refpolicy-mcs-2.20141203/policy/modules/system/xc-installer.fc b/recipes-security/refpolicy/refpolicy-mcs-2.20141203/policy/modules/system/xc-installer.fc
@@ -18,5 +18,5 @@
 #
 #############################################################################
 
-/storage/update/upgrade		--	gen_context(system_u:object_r:xc_installer_t,s0)
+/storage/update/upgrade		--	gen_context(system_u:object_r:xc_installer_storage_t,s0)
 /usr/share/xenclient/post-upgrade.sh	--	gen_context(system_u:object_r:xc_installer_exec_t,s0)
diff --git a/recipes-security/refpolicy/refpolicy-mcs-2.20141203/policy/modules/system/xc-installer.if b/recipes-security/refpolicy/refpolicy-mcs-2.20141203/policy/modules/system/xc-installer.if
@@ -48,6 +48,7 @@ interface(`xc_installer_domtrans',`
 	corecmd_search_bin($1)
 	domtrans_pattern($1, updatemgr_storage_t, xc_installer_t)
 	domtrans_pattern($1, xc_installer_exec_t, xc_installer_t)
+	allow $1 xc_installer_t:process { noatsecure siginh rlimitinh };
 ')
 ########################################
 ## <summary>
@@ -61,10 +62,11 @@ interface(`xc_installer_domtrans',`
 #
 interface(`xc_installer_delete',`
 	gen_require(`
-		type xc_installer_t;
+		type xc_installer_storage_t;
 	')
 
-	allow $1 xc_installer_t:file delete_file_perms;
+	allow $1 xc_installer_storage_t:dir manage_dir_perms;
+	allow $1 xc_installer_storage_t:file delete_file_perms;
 ')
 ########################################
 ## <summary>
Original file line number	Diff line number	Diff line change
Expand Up		@@ -82,3 +82,5 @@ allow updatemgr_t updatemgr_sync_client_storage_t:file manage_file_perms;
		allow updatemgr_t updatemgr_tmp_t:file manage_file_perms;
		allow updatemgr_t self:capability { dac_override chown fowner fsetid };

		kernel_request_load_module(updatemgr_t)