47 lines
1.8 KiB
Diff
47 lines
1.8 KiB
Diff
From 4ed22744f5a99c1f2b997b915b340de7abe8d15d Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Thu, 13 Jan 2022 21:08:14 +0100
|
|
Subject: [PATCH] Allow systemd-coredump userns capabilities and root mounton
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/4ed22744f5a99c1f2b997b915b340de7abe8d15d
|
|
Conflict: NA
|
|
|
|
systemd-coredump forks a child process to perform core file analysis
|
|
(comm=(sd-parse-elf)), and before doing the actual analysis, it sets
|
|
up a sandbox using mount and user namespaces.
|
|
|
|
Refer to https://github.com/systemd/systemd/commit/61aea456c1
|
|
for the systemd upstream change.
|
|
|
|
Resolves: rhbz#2031356
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/system/systemd.te | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
|
|
index 5a78a8c..ea2b27e 100644
|
|
--- a/policy/modules/system/systemd.te
|
|
+++ b/policy/modules/system/systemd.te
|
|
@@ -1040,7 +1040,7 @@ systemd_read_efivarfs(systemd_sysctl_t)
|
|
# setgid setuid - to set own credentials to match the dumped process credentials
|
|
# setpcap - to drop capabilities
|
|
allow systemd_coredump_t self:capability { dac_read_search net_admin setgid setpcap setuid sys_ptrace };
|
|
-allow systemd_coredump_t self:cap_userns sys_ptrace;
|
|
+allow systemd_coredump_t self:cap_userns { dac_read_search dac_override sys_admin sys_ptrace };
|
|
|
|
# To set its capability set
|
|
allow systemd_coredump_t self:process setcap;
|
|
@@ -1067,6 +1067,8 @@ domain_read_all_domains_state(systemd_coredump_t)
|
|
files_read_non_security_files(systemd_coredump_t)
|
|
files_map_non_security_files(systemd_coredump_t)
|
|
|
|
+files_mounton_rootfs(systemd_coredump_t)
|
|
+
|
|
fs_getattr_nsfs_files(systemd_coredump_t)
|
|
|
|
optional_policy(`
|
|
--
|
|
1.8.3.1
|
|
|