diff mbox series

[meta-selinux,5/5] refpolicy: donotaudit rsyslogd for net_admin capability on self

Message ID IA3PR02MB111995AD3CC1BADED7E4CDCEAF151A@IA3PR02MB11199.namprd02.prod.outlook.com
State New
Headers show
Series [meta-selinux,1/5] refpolicy: Added dontaudit on docker_t to manage /usr directory | expand

Commit Message

Gargi Misra April 2, 2026, 7:05 a.m. UTC 
refpolicy: donotaudit rsyslogd for net_admin capability on self

avc:  denied  { net_admin } for  pid=1360 comm="rsyslogd" capability=12  scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=capability permissive=1

Upstream-Status: Backport [refpolicy: donotaudit rsyslogd for net_admin capability on self * SELinuxProject/refpolicy@9ff571c<https://github.com/SELinuxProject/refpolicy/commit/9ff571c7998d62b75df2d575a3eeeff58fde12f4>]

Signed-off-by: Gargi Misra <gmisra@qti.qualcomm.com>
---
policy/modules/system/logging.te | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 0ba5d3d8b6..314b2559bf 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -399,7 +399,7 @@  optional_policy(`
# sys_admin for the integrated klog of syslog-ng and metalog
# sys_nice for rsyslog
allow syslogd_t self:capability { chown dac_override fsetid setgid setuid sys_admin sys_nice sys_resource sys_tty_config };
-dontaudit syslogd_t self:capability { sys_ptrace };
+dontaudit syslogd_t self:capability { sys_ptrace net_admin };
dontaudit syslogd_t self:cap_userns { kill sys_ptrace };
# setpgid for metalog
# setrlimit for syslog-ng