From da8b7c85dee97c773d1595d2f4e41e4426ca8b13 Mon Sep 17 00:00:00 2001 From: Jason Zaman Date: Mon, 16 Dec 2019 20:23:23 +0800 Subject: sec-policy/selinux-base: Add unknown-perms policy capability Package-Manager: Portage-2.3.79, Repoman-2.3.16 Signed-off-by: Jason Zaman --- sec-policy/selinux-base/metadata.xml | 1 + sec-policy/selinux-base/selinux-base-9999.ebuild | 15 ++++++--------- 2 files changed, 7 insertions(+), 9 deletions(-) (limited to 'sec-policy') diff --git a/sec-policy/selinux-base/metadata.xml b/sec-policy/selinux-base/metadata.xml index 16f3d9c00e66..cf565be6f044 100644 --- a/sec-policy/selinux-base/metadata.xml +++ b/sec-policy/selinux-base/metadata.xml @@ -14,5 +14,6 @@ Enable the open permissions for file object classes (SELinux policy capability). Enable User Based Access Control (UBAC) in the SELinux policy Enable support for the unconfined SELinux module + Default allow unknown classes in kernels newer than the policy (SELinux policy capability). diff --git a/sec-policy/selinux-base/selinux-base-9999.ebuild b/sec-policy/selinux-base/selinux-base-9999.ebuild index 16ee9f2b2abb..5342853efec5 100644 --- a/sec-policy/selinux-base/selinux-base-9999.ebuild +++ b/sec-policy/selinux-base/selinux-base-9999.ebuild @@ -16,7 +16,7 @@ else KEYWORDS="~amd64 -arm ~arm64 ~mips ~x86" fi -IUSE="doc +open_perms +peer_perms systemd +ubac +unconfined" +IUSE="doc +unknown-perms systemd +ubac +unconfined" DESCRIPTION="Gentoo base policy for SELinux" HOMEPAGE="https://wiki.gentoo.org/wiki/Project:SELinux" @@ -48,14 +48,11 @@ src_configure() { # Update the SELinux refpolicy capabilities based on the users' USE flags. - if ! use peer_perms; then - sed -i -e '/network_peer_controls/d' \ - "${S}/refpolicy/policy/policy_capabilities" || die - fi - - if ! use open_perms; then - sed -i -e '/open_perms/d' \ - "${S}/refpolicy/policy/policy_capabilities" || die + if use unknown-perms; then + sed -i -e '/^UNK_PERMS/s/deny/allow/' "${S}/refpolicy/build.conf" \ + || die "Failed to allow Unknown Permissions Handling" + sed -i -e '/^UNK_PERMS/s/deny/allow/' "${S}/refpolicy/Makefile" \ + || die "Failed to allow Unknown Permissions Handling" fi if ! use ubac; then -- cgit v1.2.3-65-gdbad