39 lines
1.8 KiB
Diff
39 lines
1.8 KiB
Diff
From 0fa3cc8988c28c5da8b6844cdac0d052ec48dc3b Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Wed, 12 Jan 2022 17:39:33 +0100
|
|
Subject: [PATCH] Allow administrative users the bpf capability
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/0fa3cc8988c28c5da8b6844cdac0d052ec48dc3b
|
|
Conflict: NA
|
|
|
|
The userdom_admin_user_template() template for creating an
|
|
administrative user was updated with the bpf capability so that
|
|
e. g. users in the sysadm_r role can run perf.
|
|
Addresses the following AVC denial:
|
|
|
|
type=PROCTITLE msg=audit(01/12/2022 10:45:01.065:855) : proctitle=perf record -o /dev/null echo test
|
|
type=SYSCALL msg=audit(01/12/2022 10:45:01.065:855) : arch=x86_64 syscall=bpf success=no exit=ENOENT(No such file or directory) a0=BPF_PROG_GET_NEXT_ID a1=0x7fffd756dba0 a2=0x78 a3=0x3b items=0 ppid=9065 pid=9066 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts2 ses=7 comm=perf exe=/usr/bin/perf subj=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)
|
|
type=AVC msg=audit(01/12/2022 10:45:01.065:855) : avc: denied { bpf } for pid=9066 comm=perf capability=unknown-capability(39) scontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tclass=capability2 permissive=0
|
|
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/system/userdomain.if | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
|
index cb56d28..eea0894 100644
|
|
--- a/policy/modules/system/userdomain.if
|
|
+++ b/policy/modules/system/userdomain.if
|
|
@@ -1640,6 +1640,8 @@ template(`userdom_admin_user_template',`
|
|
# $1_t local policy
|
|
#
|
|
|
|
+ allow $1_t self:capability2 bpf;
|
|
+
|
|
# Manipulate other users crontab.
|
|
allow $1_t self:passwd crontab;
|
|
|
|
--
|
|
1.8.3.1
|
|
|