34 lines
1.2 KiB
Diff
34 lines
1.2 KiB
Diff
From 3befcf9bdea867fca0d980871e251191fe234586 Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Wed, 22 Jun 2022 21:27:59 +0200
|
|
Subject: [PATCH] Allow domain use userfaultfd over all domains
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/3befcf9bdea867fca0d980871e251191fe234586
|
|
Conflict: NA
|
|
|
|
Until now, all processes were allowed to use userfaultfd as well other
|
|
anon_inodes to get a file descriptor from the same domain.
|
|
Since this commit the permissions are allowed between different domains.
|
|
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/kernel/domain.te | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
|
|
index f1e0bd6..1289b4c 100644
|
|
--- a/policy/modules/kernel/domain.te
|
|
+++ b/policy/modules/kernel/domain.te
|
|
@@ -121,7 +121,7 @@ neverallow ~{ domain unlabeled_t } *:process *;
|
|
# Rules applied to all domains
|
|
#
|
|
|
|
-allow domain self:anon_inode userfaultfd_anon_inode_perms;
|
|
+allow domain domain:anon_inode userfaultfd_anon_inode_perms;
|
|
# read /proc/(pid|self) entries
|
|
allow domain self:dir { list_dir_perms watch_dir_perms };
|
|
allow domain self:lnk_file { read_lnk_file_perms lock ioctl };
|
|
--
|
|
1.8.3.1
|
|
|