38 lines
1.6 KiB
Diff
38 lines
1.6 KiB
Diff
From c5082c2dc80dbbd549ca9a246ef97ef6cf20a277 Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Thu, 18 Nov 2021 19:29:01 +0100
|
|
Subject: [PATCH] Allow sudodomain send a null signal to sshd processes
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/c5082c2dc80dbbd549ca9a246ef97ef6cf20a277
|
|
Conflict: NA
|
|
|
|
This denial appears when maxlogins is specified in PAM limits configuration:
|
|
type=PROCTITLE msg=audit(11/18/21 13:22:44.231:774) : proctitle=sudo -u staff echo
|
|
type=SYSCALL msg=audit(11/18/21 13:22:44.231:774) : arch=x86_64 syscall=kill success=no exit=EACCES(Permission denied) a0=0x1a2c a1=SIG0 a2=0x4 a3=0x7ffd93c089cf items=0 ppid=6747 pid=6748 auid=staff uid=root gid=staff euid=root suid=root fsuid=root egid=staff sgid=staff fsgid=staff tty=(none) ses=16 comm=sudo exe=/usr/bin/sudo subj=staff_u:staff_r:staff_sudo_t:s0-s0:c0.c1023 key=(null)
|
|
type=AVC msg=audit(11/18/21 13:22:44.231:774) : avc: denied { signull } for pid=6748 comm=sudo scontext=staff_u:staff_r:staff_sudo_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=process permissive=0
|
|
|
|
Resolves: rhbz#1966945
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/admin/sudo.te | 4 ++++
|
|
1 file changed, 4 insertions(+)
|
|
|
|
diff --git a/policy/modules/admin/sudo.te b/policy/modules/admin/sudo.te
|
|
index b281028..333b465 100644
|
|
--- a/policy/modules/admin/sudo.te
|
|
+++ b/policy/modules/admin/sudo.te
|
|
@@ -129,6 +129,10 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
+ ssh_signull(sudodomain)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
systemd_write_inherited_logind_sessions_pipes(sudodomain)
|
|
')
|
|
|
|
--
|
|
1.8.3.1
|
|
|