Bug 1351627 - sync on the class/permission definitions with upstream
Summary: sync on the class/permission definitions with upstream
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 25
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-06-30 12:53 UTC by Daniel Walsh
Modified: 2016-08-17 16:44 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-3.13.1-208.fc25
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-17 03:04:52 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Daniel Walsh 2016-06-30 12:53:43 UTC
class system differs from upstream (has an "undefined" permission where
upstream has "start" and "stop").  I think Dominick raised the latter
as an issue on selinux list a while back and noted that an attempt to
add "start" and "stop" to Fedora policy in an update broke systemd,
but IIUC, that was because they were defined without allowing them to
any confined domains.

Comment 1 Jan Kurik 2016-07-26 04:37:59 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 25 development cycle.
Changing version to '25'.

Comment 2 Fedora Update System 2016-08-12 15:58:02 UTC
selinux-policy-3.13.1-208.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-662487f8f1

Comment 3 Fedora Update System 2016-08-17 03:03:11 UTC
selinux-policy-3.13.1-208.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Stephen Smalley 2016-08-17 16:44:05 UTC
It appears that you synchronized the class system permissions to match upstream (thanks for that), but you kept the "undefined" permission definition (just moved it to the end).  Is that permission actually used by systemd?  If not, the libsepol update to only warn instead of fail if the permission is not resolved should allow you to remove it altogether without breakage.


Note You need to log in before you can comment on or make changes to this bug.