diff mbox series

[meta-selinux,1/2] refpolicy_common.inc: default to deny for UNK_PERMS

Message ID 20260917042544.3894019-1-chenqi_hycx@cetc.com.cn
State New
Headers show
Series [meta-selinux,1/2] refpolicy_common.inc: default to deny for UNK_PERMS | expand

Commit Message

Chen Qi Sept. 17, 2026, 4:25 a.m. UTC 
From: Chen Qi <chenqi_hycx@cetc.com.cn>

The default value for UNK_PERMS in refpolicy is "deny", which
means if refpolicy does not have classes/permissions that kernel
define, the related rules will be "denied".

This is a more reasonable default value as "allow" will cover
problems.

Signed-off-by: Chen Qi <chenqi_hycx@cetc.com.cn>
---
 recipes-security/refpolicy/refpolicy_common.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index 1d88557..8787797 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -108,7 +108,7 @@  DEFAULT_ENFORCING ??= "enforcing"
 POLICY_NAME ?= "${POLICY_TYPE}"
 POLICY_DISTRO ?= "debian"
 POLICY_UBAC ?= "n"
-POLICY_UNK_PERMS ?= "allow"
+POLICY_UNK_PERMS ?= "deny"
 POLICY_DIRECT_INITRC ?= "y"
 POLICY_SYSTEMD ?= "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'y', 'n', d)}"
 POLICY_MONOLITHIC ?= "n"