various: various fixes

Signed-off-by: Kenton Groombridge <[email protected]>
SELinuxProject · May 9, 2024 · 27602a9 · 27602a9
1 parent 63d50bb
commit 27602a9
Show file tree

Hide file tree

Showing 6 changed files with 28 additions and 1 deletion.
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
@@ -2897,6 +2897,25 @@ interface(`dev_delete_lvm_control_dev',`
  delete_chr_files_pattern($1, device_t, lvm_control_t)
 ')
 
+########################################
+## <summary>
+## Do not audit attempts to read and write the
+## Intel Management Engine Interface device.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`dev_dontaudit_rw_mei',`
+ gen_require(`
+ type mei_device_t;
+ ')
+
+ dontaudit $1 mei_device_t:chr_file rw_chr_file_perms;
+')
+
 ########################################
 ## <summary>
 ## dontaudit getattr raw memory devices (e.g. /dev/mem).

diff --git a/policy/modules/services/kubernetes.te b/policy/modules/services/kubernetes.te
@@ -618,6 +618,8 @@ userdom_use_user_terminals(kubectl_domain)
 # kubectl local policy
 #
 
+dontaudit kubectl_t self:capability { sys_admin sys_resource };
+
 kernel_dontaudit_getattr_proc(kubectl_t)
 
 auth_use_nsswitch(kubectl_t)

diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
@@ -91,6 +91,9 @@ interface(`auth_use_pam_systemd',`
  systemd_connect_machined($1)
  systemd_dbus_chat_logind($1)
  systemd_read_logind_state($1)
+
+ # to read /etc/machine-id
+ files_read_etc_runtime_files($1)
 ')
 
 ########################################

diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
@@ -142,6 +142,7 @@ term_dontaudit_use_all_ptys(chkpwd_t)
 
 auth_read_shadow_history(chkpwd_t)
 auth_use_nsswitch(chkpwd_t)
+auth_use_pam_systemd(chkpwd_t)
 
 logging_send_audit_msgs(chkpwd_t)
 logging_send_syslog_msg(chkpwd_t)

diff --git a/policy/modules/system/raid.te b/policy/modules/system/raid.te
@@ -28,7 +28,7 @@ init_unit_file(mdadm_unit_t)
 #
 
 allow mdadm_t self:capability { dac_override ipc_lock sys_admin };
-dontaudit mdadm_t self:capability sys_tty_config;
+dontaudit mdadm_t self:capability { net_admin sys_tty_config };
 dontaudit mdadm_t self:cap_userns sys_ptrace;
 allow mdadm_t self:process { getsched setsched signal_perms };
 allow mdadm_t self:fifo_file rw_fifo_file_perms;
@@ -53,6 +53,7 @@ corecmd_exec_shell(mdadm_t)
 dev_rw_sysfs(mdadm_t)
 dev_dontaudit_getattr_all_blk_files(mdadm_t)
 dev_dontaudit_getattr_all_chr_files(mdadm_t)
+dev_dontaudit_rw_mei(mdadm_t)
 dev_read_realtime_clock(mdadm_t)
 # create links in /dev/md
 dev_create_generic_symlinks(mdadm_t)

diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
@@ -511,6 +511,7 @@ seutil_domtrans_semanage(selinux_dbus_t)
 #
 
 allow semanage_t self:capability { audit_write dac_override };
+dontaudit semanage_t self:capability { sys_admin sys_resource };
 allow semanage_t self:unix_stream_socket create_stream_socket_perms;
 allow semanage_t self:unix_dgram_socket create_socket_perms;
 allow semanage_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };