gentoo-mirror/gentoo
1
0
Fork 0
mirror of https://github.com/gentoo-mirror/gentoo.git synced 2026-09-24 04:59:14 -07:00
Code Issues Projects Releases Wiki Activity

sec-policy/selinux-base: Add unknown-perms policy capability

Browse Source 
Package-Manager: Portage-2.3.79, Repoman-2.3.16
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
This commit is contained in:
Jason Zaman
2019-12-16 20:23:23 +08:00
parent 42cca0f552
commit da8b7c85de
2 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
sec-policy/selinux-base/metadata.xml
View File

@@ -14,5 +14,6 @@
<flag name="open_perms">Enable the open permissions for file object classes (SELinux policy capability).</flag>
<flag name="ubac">Enable User Based Access Control (UBAC) in the SELinux policy</flag>
<flag name="unconfined">Enable support for the unconfined SELinux module</flag>
<flag name="unknown-perms">Default allow unknown classes in kernels newer than the policy (SELinux policy capability).</flag>
</use>
</pkgmetadata>

15
sec-policy/selinux-base/selinux-base-9999.ebuild
View File

@@ -16,7 +16,7 @@ else
KEYWORDS="~amd64 -arm ~arm64 ~mips ~x86"
fi
IUSE="doc +open_perms +peer_perms systemd +ubac +unconfined"
IUSE="doc +unknown-perms systemd +ubac +unconfined"
DESCRIPTION="Gentoo base policy for SELinux"
HOMEPAGE="https://wiki.gentoo.org/wiki/Project:SELinux"
@@ -48,14 +48,11 @@ src_configure() {
# Update the SELinux refpolicy capabilities based on the users' USE flags.
if ! use peer_perms; then
sed -i -e '/network_peer_controls/d' \
"${S}/refpolicy/policy/policy_capabilities" || die
fi
if ! use open_perms; then
sed -i -e '/open_perms/d' \
"${S}/refpolicy/policy/policy_capabilities" || die
if use unknown-perms; then
sed -i -e '/^UNK_PERMS/s/deny/allow/' "${S}/refpolicy/build.conf" \
|| die "Failed to allow Unknown Permissions Handling"
sed -i -e '/^UNK_PERMS/s/deny/allow/' "${S}/refpolicy/Makefile" \
|| die "Failed to allow Unknown Permissions Handling"
fi
if ! use ubac; then