diff mbox series

[meta-selinux,4/5] refpolicy: Added policy for modprob to read blacklist-video.conf lnk_file

Message ID IA3PR02MB11199A73D31A8C41023F0CC25F151A@IA3PR02MB11199.namprd02.prod.outlook.com
State New
Headers show
Series [meta-selinux,1/5] refpolicy: Added dontaudit on docker_t to manage /usr directory | expand

Commit Message

Gargi Misra April 2, 2026, 7:03 a.m. UTC 
refpolicy: Added policy for modprob to read blacklist-video.conf lnk_file

avc:  denied  { read } for  pid=774 comm="modprobe" name="blacklist-video.conf" dev="sda2" ino=342 scontext=system_u:system_r:kmod_t:s0 tcontext=system_u:object_r:modules_conf_t:s0 tclass=lnk_file permissive=1

Upstream-Status: Backport [refpolicy: Added policy for modprob to read blacklist-video.conf lnk_... * SELinuxProject/refpolicy@aa35084<https://github.com/SELinuxProject/refpolicy/commit/aa350841e9dcaa525c0f8716c2854ca9dd728961>]

Signed-off-by: Gargi Misra <gmisra@qti.qualcomm.com>
---
policy/modules/system/modutils.te | 1 +
1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
index 7355255e0d..fa06e9ec37 100644
--- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te
@@ -45,6 +45,7 @@  allow kmod_t self:key write;
# Read module config and dependency information
list_dirs_pattern(kmod_t, modules_conf_t, modules_conf_t)
read_files_pattern(kmod_t, modules_conf_t, modules_conf_t)
+read_lnk_files_pattern(kmod_t, modules_conf_t, modules_conf_t)
allow kmod_t modules_dep_t:file map;
list_dirs_pattern(kmod_t, modules_dep_t, modules_dep_t)
manage_files_pattern(kmod_t, modules_dep_t, modules_dep_t)