36 lines
1.3 KiB
Diff
36 lines
1.3 KiB
Diff
From 8cc57cc64467d6e60eac92d6ffc9f9d550e948a2 Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Wed, 21 Sep 2022 17:20:28 +0200
|
|
Subject: [PATCH] Add numad the ipc_owner capability
|
|
|
|
This permission is required when the cpu allocation in a vm definition contains
|
|
<vcpu placement="auto" />
|
|
which means cpuset option will be configured by querying numad.
|
|
|
|
Addresses the following AVC denial:
|
|
|
|
type=AVC msg=audit(1637903670.950:2626): avc: denied { ipc_owner } for pid=72952 comm="numad" capability=15 scontext=system_u:system_r:numad_t:s0-s0:c0.c1023 tcontext=system_u:system_r:numad_t:s0-s0:c0.c1023 tclass=capability permissive=0
|
|
|
|
Resolves: rhbz#2026968
|
|
Signed-off-by: lujie42 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/contrib/numad.te | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/policy/modules/contrib/numad.te b/policy/modules/contrib/numad.te
|
|
index cf8f99b02..97f923b25 100644
|
|
--- a/policy/modules/contrib/numad.te
|
|
+++ b/policy/modules/contrib/numad.te
|
|
@@ -23,7 +23,7 @@ files_pid_file(numad_var_run_t)
|
|
# numad local policy
|
|
#
|
|
|
|
-allow numad_t self:capability { kill sys_nice sys_ptrace } ;
|
|
+allow numad_t self:capability { ipc_owner kill sys_nice sys_ptrace } ;
|
|
allow numad_t self:fifo_file rw_fifo_file_perms;
|
|
allow numad_t self:msgq create_msgq_perms;
|
|
allow numad_t self:msg { send receive };
|
|
--
|
|
2.27.0
|
|
|