C10s 20250103 build

dist/targeted/modules.conf

@@ -3092,3 +3092,11 @@ iiosensorproxy = module
 #
 #
 pcm = module
+
+# Layer: contrib
+# Module: ktls
+#
+# Policy for ktls - TLS handshake agent for kernel sockets
+#
+#
+ktls = module

policy/modules/contrib/gnome_remote_desktop.te

@@ -62,6 +62,10 @@ optional_policy(`
 	miscfiles_read_localization(gnome_remote_desktop_t)
 ')
 
+optional_policy(`
+	policykit_dbus_chat(gnome_remote_desktop_t)
+')
+
 optional_policy(`
 	systemd_login_list_pid_dirs(gnome_remote_desktop_t)
 	systemd_login_read_pid_files(gnome_remote_desktop_t)

policy/modules/contrib/keyutils.te

@@ -22,9 +22,11 @@ allow keyutils_request_t keyutils_request_exec_t:file execute_no_trans;
 
 corecmd_exec_bin(keyutils_request_t)
 
-domain_read_view_all_domains_keyrings(keyutils_request_t)
+domain_manage_all_domains_keyrings(keyutils_request_t)
 
-init_write_key(keyutils_request_t)
+optional_policy(`
+	auth_read_passwd(keyutils_request_t)
+')
 
 optional_policy(`
 	init_search_pid_dirs(keyutils_request_t)

policy/modules/contrib/ktls.fc

@@ -0,0 +1 @@
+/usr/sbin/tlshd		--	gen_context(system_u:object_r:ktlshd_exec_t,s0)

policy/modules/contrib/ktls.if

@@ -0,0 +1 @@
+## <summary>ktls - TLS handshake agent for kernel sockets</summary>

policy/modules/contrib/ktls.te

@@ -0,0 +1,19 @@
+policy_module(ktls, 1.0)
+
+########################################
+#
+# Declarations
+#
+
+type ktlshd_t;
+type ktlshd_exec_t;
+init_daemon_domain(ktlshd_t, ktlshd_exec_t)
+
+permissive ktlshd_t;
+
+allow ktlshd_t self:netlink_generic_socket create_socket_perms;
+allow ktlshd_t self:unix_dgram_socket create_socket_perms;
+
+optional_policy(`
+	logging_send_syslog_msg(ktlshd_t)
+')

policy/modules/contrib/virt.if

@@ -2141,3 +2141,22 @@ interface(`virt_manage_qemu_pid_sock_files',`
        files_search_pids($1)
        manage_sock_files_pattern($1, qemu_var_run_t, qemu_var_run_t)
 ')
+
+########################################
+## <summary>
+##	Allow the specified domain to ioctl
+##	virtqemud over a unix domain stream socket.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`virt_virtqemud_ioctl_stream_sockets',`
+	gen_require(`
+		type virtqemud_t;
+	')
+
+	allow $1 virtqemud_t:unix_stream_socket ioctl;
+')

policy/modules/contrib/virt.te

@@ -2107,14 +2107,17 @@ allow virtqemud_t self:capability2 { bpf perfmon };
 allow virtqemud_t self:cap_userns kill;
 
 allow virtqemud_t self:netlink_audit_socket { nlmsg_relay read write };
-allow virtqemud_t self:process { setcap setexec setrlimit setsched setsockcreate };
+allow virtqemud_t self:process { getpgid setcap setexec setrlimit setsched setsockcreate };
 allow virtqemud_t self:tcp_socket create_socket_perms;
-allow virtqemud_t self:tun_socket create;
+allow virtqemud_t self:tun_socket { create relabelfrom relabelto };
 allow virtqemud_t self:udp_socket { connect create getattr };
 
 allow virtqemud_t qemu_var_run_t:{ dir file sock_file } relabelfrom;
 
-allow virtqemud_t svirt_t:process { getattr setsched signal signull transition };
+allow virtqemud_t svirt_t:netlink_route_socket create_netlink_socket_perms;
+allow virtqemud_t svirt_t:process { getattr getrlimit setsched signal signull transition };
+allow virtqemud_t svirt_t:tcp_socket create_stream_socket_perms;
+allow virtqemud_t svirt_t:udp_socket create_socket_perms;
 allow virtqemud_t svirt_t:unix_stream_socket { connectto create_stream_socket_perms };
 allow virtqemud_t svirt_socket_t:unix_stream_socket connectto;
 
@@ -2144,7 +2147,7 @@ files_lock_filetrans(virtqemud_t, virtqemud_lock_t, file)
 
 allow virtqemud_t virtqemud_var_run_t:dir relabelfrom;
 allow virtqemud_t virtqemud_var_run_t:sock_file relabelfrom;
-allow virtqemud_t virt_log_t:file relabelfrom;
+allow virtqemud_t virt_log_t:file relabel_file_perms;
 
 manage_dirs_pattern(virtqemud_t, virt_var_run_t, virt_var_run_t)
 manage_dirs_pattern(virtqemud_t, virtqemud_var_run_t, virtqemud_var_run_t)
@@ -2257,7 +2260,10 @@ tunable_policy(`virtqemud_use_execmem',`
 ')
 
 tunable_policy(`virt_use_nfs',`
+	fs_manage_nfs_dirs(virtqemud_t)
 	fs_manage_nfs_files(virtqemud_t)
+	fs_read_nfs_symlinks(virtqemud_t)
+	fs_mmap_nfs_files(virtqemud_t)
 ')
 
 optional_policy(`
@@ -2268,6 +2274,10 @@ optional_policy(`
 	dnsmasq_filetrans_named_content_fromdir(virtqemud_t, virtqemud_var_run_t)
 ')
 
+optional_policy(`
+	numad_domtrans(virtqemud_t)
+')
+
 optional_policy(`
 	qemu_exec(virtqemud_t)
 ')
@@ -2288,6 +2298,7 @@ optional_policy(`
 
 optional_policy(`
 	ssh_domtrans_ssh(virtqemud_t)
+	ssh_signal(virtqemud_t)
 ')
 
 optional_policy(`

policy/modules/services/ssh.te

@@ -262,6 +262,14 @@ optional_policy(`
 	kerberos_read_keytab(ssh_t)
 ')
 
+optional_policy(`
+	systemd_read_conf_files(ssh_t)
+')
+
+optional_policy(`
+	virt_virtqemud_ioctl_stream_sockets(ssh_t)
+')
+
 optional_policy(`
 	xserver_user_x_domain_template(ssh, ssh_t, ssh_tmpfs_t)
 	xserver_domtrans_xauth(ssh_t)