From 8cc57cc64467d6e60eac92d6ffc9f9d550e948a2 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Wed, 21 Sep 2022 17:20:28 +0200 Subject: [PATCH] Add numad the ipc_owner capability This permission is required when the cpu allocation in a vm definition contains which means cpuset option will be configured by querying numad. Addresses the following AVC denial: type=AVC msg=audit(1637903670.950:2626): avc: denied { ipc_owner } for pid=72952 comm="numad" capability=15 scontext=system_u:system_r:numad_t:s0-s0:c0.c1023 tcontext=system_u:system_r:numad_t:s0-s0:c0.c1023 tclass=capability permissive=0 Resolves: rhbz#2026968 Signed-off-by: lujie42 --- policy/modules/contrib/numad.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/modules/contrib/numad.te b/policy/modules/contrib/numad.te index cf8f99b02..97f923b25 100644 --- a/policy/modules/contrib/numad.te +++ b/policy/modules/contrib/numad.te @@ -23,7 +23,7 @@ files_pid_file(numad_var_run_t) # numad local policy # -allow numad_t self:capability { kill sys_nice sys_ptrace } ; +allow numad_t self:capability { ipc_owner kill sys_nice sys_ptrace } ; allow numad_t self:fifo_file rw_fifo_file_perms; allow numad_t self:msgq create_msgq_perms; allow numad_t self:msg { send receive }; -- 2.27.0