| Message ID | 4a8dcdf93c4a51793e95ba1e2ffa9ef1f12a37c4.1794453367.git.wenwfu@qti.qualcomm.com |
|---|---|
| State | New |
| Headers | show |
| Series | [meta-selinux,v2] refpolicy: backport perf event access for unconfined domains | expand |
Hi Wenwen, Could you please bump refpolicy's SRCREV to latest? For master branch, I'd like to bump SRCREV to include fixes if the fix is not OE specific. In contrast, for stable branches such as wrynose or blacksail, back porting patch is preferred. Regards, Qi On 11/12/26 11:19, Wenwen Fu via yocto-patches wrote: > Unconfined domains lack the perf_event permissions needed by perf to > collect performance counters and tracepoints with SELinux enforcing. > > Backport refpolicy commit 6072cfa851a3 ("unconfined: allow perf event > access for unconfined domains") to refpolicy-targeted to allow access > to their own perf events. > > Assisted-by: Codex:GPT-6 > Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> > --- > Changes in v2: > - Add the meta-selinux subject prefix. > - Add backport to the subject and clarify the commit message. > > .../refpolicy/refpolicy-targeted_git.bb | 1 + > ...-event-access-for-unconfined-domains.patch | 35 +++++++++++++++++++ > 2 files changed, 36 insertions(+) > create mode 100644 recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch > > diff --git a/recipes-security/refpolicy/refpolicy-targeted_git.bb b/recipes-security/refpolicy/refpolicy-targeted_git.bb > index b4bec46..981f772 100644 > --- a/recipes-security/refpolicy/refpolicy-targeted_git.bb > +++ b/recipes-security/refpolicy/refpolicy-targeted_git.bb > @@ -14,4 +14,5 @@ include refpolicy_${PV}.inc > SRC_URI += " \ > file://0001-refpolicy-targeted-Revert-users-Move-unconfined_u-definition-to-unconfi.patch \ > file://0002-refpolicy-targeted-make-unconfined_u-the-default-sel.patch \ > + file://0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch \ > " > diff --git a/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch b/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch > new file mode 100644 > index 0000000..a356218 > --- /dev/null > +++ b/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch > @@ -0,0 +1,35 @@ > +From 6072cfa851a3598bfa86622dff9c680c2e662901 Mon Sep 17 00:00:00 2001 > +From: Wenwen Fu <wenwfu@qti.qualcomm.com> > +Date: Thu, 5 Nov 2026 10:02:03 +0800 > +Subject: [PATCH] unconfined: allow perf event access for unconfined domains > + > +Unconfined domains have the perfmon capability but lack complete > +perf_event permissions. This prevents perf from collecting performance > +counters and tracepoints with SELinux enforcing. > + > +Allow unconfined domains to open, read and control their own perf > +events, including CPU, kernel and tracepoint collection. Add the rule > +to unconfined_domain_noaudit() alongside the other self access rules. > + > +Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/6072cfa851a3598bfa86622dff9c680c2e662901] > + > +Assisted-by: Codex:GPT-6 > +Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> > +--- > + policy/modules/system/unconfined.if | 3 +++ > + 1 file changed, 3 insertions(+) > + > +diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if > +index 6c48561238..c627d38dcf 100644 > +--- a/policy/modules/system/unconfined.if > ++++ b/policy/modules/system/unconfined.if > +@@ -59,6 +59,9 @@ interface(`unconfined_domain_noaudit',` > + # for io_uring > + allow $1 self:anon_inode { create map read write }; > + > ++ # Access own perf events > ++ allow $1 self:perf_event { open cpu kernel tracepoint read write }; > ++ > + # Userland object managers > + allow $1 self:nscd { admin getgrp gethost getpwd getserv getstat shmemgrp shmemhost shmempwd shmemserv }; > + allow $1 self:dbus { acquire_svc send_msg };
diff --git a/recipes-security/refpolicy/refpolicy-targeted_git.bb b/recipes-security/refpolicy/refpolicy-targeted_git.bb index b4bec46..981f772 100644 --- a/recipes-security/refpolicy/refpolicy-targeted_git.bb +++ b/recipes-security/refpolicy/refpolicy-targeted_git.bb @@ -14,4 +14,5 @@ include refpolicy_${PV}.inc SRC_URI += " \ file://0001-refpolicy-targeted-Revert-users-Move-unconfined_u-definition-to-unconfi.patch \ file://0002-refpolicy-targeted-make-unconfined_u-the-default-sel.patch \ + file://0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch \ " diff --git a/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch b/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch new file mode 100644 index 0000000..a356218 --- /dev/null +++ b/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch @@ -0,0 +1,35 @@ +From 6072cfa851a3598bfa86622dff9c680c2e662901 Mon Sep 17 00:00:00 2001 +From: Wenwen Fu <wenwfu@qti.qualcomm.com> +Date: Thu, 5 Nov 2026 10:02:03 +0800 +Subject: [PATCH] unconfined: allow perf event access for unconfined domains + +Unconfined domains have the perfmon capability but lack complete +perf_event permissions. This prevents perf from collecting performance +counters and tracepoints with SELinux enforcing. + +Allow unconfined domains to open, read and control their own perf +events, including CPU, kernel and tracepoint collection. Add the rule +to unconfined_domain_noaudit() alongside the other self access rules. + +Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/6072cfa851a3598bfa86622dff9c680c2e662901] + +Assisted-by: Codex:GPT-6 +Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> +--- + policy/modules/system/unconfined.if | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if +index 6c48561238..c627d38dcf 100644 +--- a/policy/modules/system/unconfined.if ++++ b/policy/modules/system/unconfined.if +@@ -59,6 +59,9 @@ interface(`unconfined_domain_noaudit',` + # for io_uring + allow $1 self:anon_inode { create map read write }; + ++ # Access own perf events ++ allow $1 self:perf_event { open cpu kernel tracepoint read write }; ++ + # Userland object managers + allow $1 self:nscd { admin getgrp gethost getpwd getserv getstat shmemgrp shmemhost shmempwd shmemserv }; + allow $1 self:dbus { acquire_svc send_msg };
Unconfined domains lack the perf_event permissions needed by perf to collect performance counters and tracepoints with SELinux enforcing. Backport refpolicy commit 6072cfa851a3 ("unconfined: allow perf event access for unconfined domains") to refpolicy-targeted to allow access to their own perf events. Assisted-by: Codex:GPT-6 Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> --- Changes in v2: - Add the meta-selinux subject prefix. - Add backport to the subject and clarify the commit message. .../refpolicy/refpolicy-targeted_git.bb | 1 + ...-event-access-for-unconfined-domains.patch | 35 +++++++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch