| Message ID | 20261112055125.704676-1-wenwfu@qti.qualcomm.com |
|---|---|
| State | New |
| Headers | show |
| Series | [meta-selinux,wrynose] refpolicy: backport perf event access for unconfined domains | expand |
The patch should be in refpolicy_common.inc because the `unconfined` module is used by all refpolicy variants. Regards, Qi On 11/12/26 13:51, Wenwen Fu via yocto-patches wrote: > Unconfined domains lack the perf_event permissions needed by perf to > collect performance counters and tracepoints with SELinux enforcing. > > Backport refpolicy commit 6072cfa851a3 ("unconfined: allow perf event > access for unconfined domains") to refpolicy-targeted to allow access > to their own perf events. > > Assisted-by: Codex:GPT-6 > Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> > --- > .../refpolicy/refpolicy-targeted_git.bb | 1 + > ...-event-access-for-unconfined-domains.patch | 35 +++++++++++++++++++ > 2 files changed, 36 insertions(+) > create mode 100644 recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch > > diff --git a/recipes-security/refpolicy/refpolicy-targeted_git.bb b/recipes-security/refpolicy/refpolicy-targeted_git.bb > index 321407d..a416854 100644 > --- a/recipes-security/refpolicy/refpolicy-targeted_git.bb > +++ b/recipes-security/refpolicy/refpolicy-targeted_git.bb > @@ -15,4 +15,5 @@ include refpolicy_${PV}.inc > SRC_URI += " \ > file://0001-refpolicy-targeted-Revert-users-Move-unconfined_u-definition-to-unconfi.patch \ > file://0002-refpolicy-targeted-make-unconfined_u-the-default-sel.patch \ > + file://0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch \ > " > diff --git a/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch b/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch > new file mode 100644 > index 0000000..a356218 > --- /dev/null > +++ b/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch > @@ -0,0 +1,35 @@ > +From 6072cfa851a3598bfa86622dff9c680c2e662901 Mon Sep 17 00:00:00 2001 > +From: Wenwen Fu <wenwfu@qti.qualcomm.com> > +Date: Thu, 5 Nov 2026 10:02:03 +0800 > +Subject: [PATCH] unconfined: allow perf event access for unconfined domains > + > +Unconfined domains have the perfmon capability but lack complete > +perf_event permissions. This prevents perf from collecting performance > +counters and tracepoints with SELinux enforcing. > + > +Allow unconfined domains to open, read and control their own perf > +events, including CPU, kernel and tracepoint collection. Add the rule > +to unconfined_domain_noaudit() alongside the other self access rules. > + > +Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/6072cfa851a3598bfa86622dff9c680c2e662901] > + > +Assisted-by: Codex:GPT-6 > +Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> > +--- > + policy/modules/system/unconfined.if | 3 +++ > + 1 file changed, 3 insertions(+) > + > +diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if > +index 6c48561238..c627d38dcf 100644 > +--- a/policy/modules/system/unconfined.if > ++++ b/policy/modules/system/unconfined.if > +@@ -59,6 +59,9 @@ interface(`unconfined_domain_noaudit',` > + # for io_uring > + allow $1 self:anon_inode { create map read write }; > + > ++ # Access own perf events > ++ allow $1 self:perf_event { open cpu kernel tracepoint read write }; > ++ > + # Userland object managers > + allow $1 self:nscd { admin getgrp gethost getpwd getserv getstat shmemgrp shmemhost shmempwd shmemserv }; > + allow $1 self:dbus { acquire_svc send_msg };
diff --git a/recipes-security/refpolicy/refpolicy-targeted_git.bb b/recipes-security/refpolicy/refpolicy-targeted_git.bb index 321407d..a416854 100644 --- a/recipes-security/refpolicy/refpolicy-targeted_git.bb +++ b/recipes-security/refpolicy/refpolicy-targeted_git.bb @@ -15,4 +15,5 @@ include refpolicy_${PV}.inc SRC_URI += " \ file://0001-refpolicy-targeted-Revert-users-Move-unconfined_u-definition-to-unconfi.patch \ file://0002-refpolicy-targeted-make-unconfined_u-the-default-sel.patch \ + file://0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch \ " diff --git a/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch b/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch new file mode 100644 index 0000000..a356218 --- /dev/null +++ b/recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch @@ -0,0 +1,35 @@ +From 6072cfa851a3598bfa86622dff9c680c2e662901 Mon Sep 17 00:00:00 2001 +From: Wenwen Fu <wenwfu@qti.qualcomm.com> +Date: Thu, 5 Nov 2026 10:02:03 +0800 +Subject: [PATCH] unconfined: allow perf event access for unconfined domains + +Unconfined domains have the perfmon capability but lack complete +perf_event permissions. This prevents perf from collecting performance +counters and tracepoints with SELinux enforcing. + +Allow unconfined domains to open, read and control their own perf +events, including CPU, kernel and tracepoint collection. Add the rule +to unconfined_domain_noaudit() alongside the other self access rules. + +Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/6072cfa851a3598bfa86622dff9c680c2e662901] + +Assisted-by: Codex:GPT-6 +Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> +--- + policy/modules/system/unconfined.if | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if +index 6c48561238..c627d38dcf 100644 +--- a/policy/modules/system/unconfined.if ++++ b/policy/modules/system/unconfined.if +@@ -59,6 +59,9 @@ interface(`unconfined_domain_noaudit',` + # for io_uring + allow $1 self:anon_inode { create map read write }; + ++ # Access own perf events ++ allow $1 self:perf_event { open cpu kernel tracepoint read write }; ++ + # Userland object managers + allow $1 self:nscd { admin getgrp gethost getpwd getserv getstat shmemgrp shmemhost shmempwd shmemserv }; + allow $1 self:dbus { acquire_svc send_msg };
Unconfined domains lack the perf_event permissions needed by perf to collect performance counters and tracepoints with SELinux enforcing. Backport refpolicy commit 6072cfa851a3 ("unconfined: allow perf event access for unconfined domains") to refpolicy-targeted to allow access to their own perf events. Assisted-by: Codex:GPT-6 Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> --- .../refpolicy/refpolicy-targeted_git.bb | 1 + ...-event-access-for-unconfined-domains.patch | 35 +++++++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 recipes-security/refpolicy/refpolicy/0003-unconfined-allow-perf-event-access-for-unconfined-domains.patch