From 3befcf9bdea867fca0d980871e251191fe234586 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Wed, 22 Jun 2022 21:27:59 +0200 Subject: [PATCH] Allow domain use userfaultfd over all domains Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/3befcf9bdea867fca0d980871e251191fe234586 Conflict: NA Until now, all processes were allowed to use userfaultfd as well other anon_inodes to get a file descriptor from the same domain. Since this commit the permissions are allowed between different domains. Signed-off-by: lujie54 --- policy/modules/kernel/domain.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te index f1e0bd6..1289b4c 100644 --- a/policy/modules/kernel/domain.te +++ b/policy/modules/kernel/domain.te @@ -121,7 +121,7 @@ neverallow ~{ domain unlabeled_t } *:process *; # Rules applied to all domains # -allow domain self:anon_inode userfaultfd_anon_inode_perms; +allow domain domain:anon_inode userfaultfd_anon_inode_perms; # read /proc/(pid|self) entries allow domain self:dir { list_dir_perms watch_dir_perms }; allow domain self:lnk_file { read_lnk_file_perms lock ioctl }; -- 1.8.3.1