Release 9.0.0

policy/modules/services/container.te

@@ -751,9 +751,14 @@ kernel_read_vm_overcommit_sysctl(container_engine_t)
 
 kernel_search_vm_sysctl(container_engine_t)
 
+kernel_request_load_module(container_engine_t)
+
 term_remount_devpts(container_engine_t)
 
 init_rw_script_stream_sockets(container_engine_t)
+init_manage_utmp(container_engine_t)
+init_manage_dir_utmp(container_engine_t)
+init_mounton_initrc_runtime(container_engine_t)
 
 ifdef(`init_systemd',`
 	# needed by runc, which is also invoked by other engines

policy/modules/services/dnsmasq.te

@@ -53,6 +53,8 @@ allow dnsmasq_t dnsmasq_var_log_t:file setattr_file_perms;
 files_read_runtime_files(dnsmasq_t)
 systemd_read_resolved_dir(dnsmasq_t)
 files_map_etc_files(dnsmasq_t)
+init_manage_utmp(dnsmasq_t)
+init_manage_dir_utmp(dnsmasq_t)
 
 systemd_read_resolved_runtime(dnsmasq_t)
 
@@ -108,6 +110,10 @@ userdom_dontaudit_search_user_home_dirs(dnsmasq_t)
 
 files_manage_quota_aos(dnsmasq_t)
 
+init_rw_script_stream_sockets(dnsmasq_t)
+
+aos_rw_conf(dnsmasq_t)
+
 dev_rw_tee_chr_files(dnsmasq_t)
 
 kernel_use_fds(dnsmasq_t)

policy/modules/services/rpc.te

@@ -118,6 +118,8 @@ corenet_tcp_bind_generic_port(rpc_domain)
 corenet_udp_bind_generic_port(rpc_domain)
 corenet_tcp_bind_all_rpc_ports(rpc_domain)
 corenet_udp_bind_all_rpc_ports(rpc_domain)
+corenet_tcp_bind_all_unreserved_ports(rpc_domain)
+corenet_udp_bind_all_unreserved_ports(rpc_domain)
 
 fs_rw_rpc_named_pipes(rpc_domain)
 fs_search_auto_mountpoints(rpc_domain)
@@ -245,6 +247,7 @@ can_exec(rpcd_t, rpcd_exec_t)
 
 kernel_read_network_state(rpcd_t)
 kernel_read_sysctl(rpcd_t)
+kernel_read_net_sysctls(rpcd_t)
 kernel_rw_fs_sysctls(rpcd_t)
 kernel_dontaudit_getattr_core_if(rpcd_t)
 kernel_signal(rpcd_t)
@@ -309,6 +312,10 @@ optional_policy(`
 	quota_manage_db_files(rpcd_t)
 ')
 
+optional_policy(`
+	aos_get_fs_quotas(rpcd_t)
+')
+
 optional_policy(`
 	unconfined_signal(rpcd_t)
 ')

policy/modules/system/aos.if

@@ -167,6 +167,24 @@ interface(`files_manage_quota_aos',`
 	allow $1 aos_var_run_t:filesystem { quotaget quotamod remount getattr };
 ')
 
+########################################
+## <summary>
+##	Get quotas on aos filesystem.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`aos_get_fs_quotas',`
+	gen_require(`
+		type aos_var_run_t;
+	')
+
+	allow $1 aos_var_run_t:filesystem quotaget;
+')
+
 # allow $1 aos_var_run_t:file { getattr };
 
 ########################################
@@ -206,6 +224,25 @@ interface(`files_manage_overlay_aos',`
 ')	
 
 
+########################################
+## <summary>
+##	Read and write aos conf directories and files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`aos_rw_conf',`
+	gen_require(`
+		type aos_conf_t;
+	')
+
+	allow $1 aos_conf_t:dir rw_dir_perms;
+	allow $1 aos_conf_t:file rw_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Allow relabeled /var/aos directory.

policy/modules/system/init.if

@@ -3094,6 +3094,25 @@ interface(`init_manage_dir_utmp',`
 	allow $1 initrc_runtime_t:dir manage_dir_perms;
 ')
 
+########################################
+## <summary>
+##	Mounton initrc runtime files and directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`init_mounton_initrc_runtime',`
+	gen_require(`
+		type initrc_runtime_t;
+	')
+
+	allow $1 initrc_runtime_t:dir mounton;
+	allow $1 initrc_runtime_t:file mounton;
+')
+
 ########################################
 ## <summary>
 ##	Remove chr file perms from utmp.

policy/modules/system/iptables.te

@@ -93,6 +93,7 @@ init_use_script_ptys(iptables_t)
 init_rw_script_pipes(iptables_t)
 init_rw_script_tmp_files(iptables_t)
 init_rw_script_stream_sockets(iptables_t)
+init_read_utmp(iptables_t)
 
 logging_send_syslog_msg(iptables_t)