Add allow rules for puppet based on Orions AVCs in Rawhide

diff --git a/policy/modules/services/cfengine.if b/policy/modules/services/cfengine.if
index 12fe9ce5ca14e089548a2c0bd48309ba014a3fda..883b697846dff55e14ecc36d91b2846841f9660a 100644 (file)
--- a/policy/modules/services/cfengine.if
+++ b/policy/modules/services/cfengine.if
@@ -21,3 +21,22 @@ interface(`cfengine_domtrans_server',`
        domtrans_pattern($1, cfengine_server_exec_t, cfengine_server_t)
 ')
 
+########################################
+## <summary>
+##     Read cfengine lib files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`cfengine_read_lib_files',`
+       gen_require(`
+               type cfengine_var_lib_t;
+       ')
+
+       files_search_var_lib($1)
+       read_files_pattern($1, cfengine_var_lib_t, cfengine_var_lib_t)
+')
+

diff --git a/policy/modules/services/icecast.te b/policy/modules/services/icecast.te
index 1c02a45e211e8dfcd1b68be8c62857ab7147514e..f4dc09236918876366537e48292da25828a21ef4 100644 (file)
--- a/policy/modules/services/icecast.te
+++ b/policy/modules/services/icecast.te
@@ -47,6 +47,8 @@ files_pid_filetrans(icecast_t, icecast_var_run_t, { file dir })
 
 kernel_read_system_state(icecast_t)
 
+dev_read_sysfs(icecast_t)
+
 corenet_tcp_bind_soundd_port(icecast_t)
 corenet_tcp_connect_soundd_port(icecast_t)
 

diff --git a/policy/modules/services/puppet.te b/policy/modules/services/puppet.te
index 5f6e7b8e8d6d72720b59e74ec979d87ef81cb5ca..5dbb9b85ce702c338c5274d73fbff25c7cba3aaa 100644 (file)
--- a/policy/modules/services/puppet.te
+++ b/policy/modules/services/puppet.te
@@ -92,7 +92,10 @@ kernel_dontaudit_search_sysctl(puppet_t)
 kernel_dontaudit_search_kernel_sysctl(puppet_t)
 kernel_read_system_state(puppet_t)
 kernel_read_crypto_sysctls(puppet_t)
+kernel_read_kernel_sysctls(puppet_t)
 
+corecmd_read_all_executables(puppet_t)
+corecmd_dontaudit_access_all_executables(puppet_t)
 corecmd_exec_bin(puppet_t)
 corecmd_exec_shell(puppet_t)
 
@@ -115,6 +118,7 @@ files_manage_config_files(puppet_t)
 files_manage_config_dirs(puppet_t)
 files_manage_etc_dirs(puppet_t)
 files_manage_etc_files(puppet_t)
+files_read_usr_files(puppet_t)
 files_read_usr_symlinks(puppet_t)
 files_relabel_config_dirs(puppet_t)
 files_relabel_config_files(puppet_t)
@@ -127,6 +131,9 @@ selinux_validate_context(puppet_t)
 term_dontaudit_getattr_unallocated_ttys(puppet_t)
 term_dontaudit_getattr_all_ttys(puppet_t)
 
+auth_use_nsswitch(puppet_t)
+auth_read_passwd(puppet_t)
+
 init_all_labeled_script_domtrans(puppet_t)
 init_domtrans_script(puppet_t)
 init_read_utmp(puppet_t)
@@ -139,6 +146,7 @@ miscfiles_read_localization(puppet_t)
 
 seutil_domtrans_setfiles(puppet_t)
 seutil_domtrans_semanage(puppet_t)
+seutil_read_file_contexts(puppet_t)
 
 sysnet_dns_name_resolve(puppet_t)
 sysnet_run_ifconfig(puppet_t, system_r)
@@ -147,6 +155,10 @@ tunable_policy(`puppet_manage_all_files',`
        files_manage_non_security_files(puppet_t)
 ')
 
+optional_policy(`
+       cfengine_read_lib_files(puppet_t)
+')
+
 optional_policy(`
        consoletype_domtrans(puppet_t)
 ')
@@ -159,6 +171,10 @@ optional_policy(`
        mount_domtrans(puppet_t)
 ')
 
+optional_policy(`
+       mta_send_mail(puppet_t)
+')
+
 optional_policy(`
        files_rw_var_files(puppet_t)