diff mbox series

[meta-selinux,scarthgap] refpolicy: locallogin - dontaudit sulogin_t checkpoint_restore

Message ID c8ad8f69-0ef1-478c-8ff5-3919d0c3cb95@gmail.com
State New
Headers show
Series [meta-selinux,scarthgap] refpolicy: locallogin - dontaudit sulogin_t checkpoint_restore | expand

Commit Message

Clayton Casciato April 8, 2025, 2 p.m. UTC 
Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
---
 ...ystem-locallogin-dontaudit-sulogin_t.patch | 53 +++++++++++++++++++
 .../refpolicy/refpolicy_common.inc            |  1 +
 2 files changed, 54 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy/0063-policy-modules-system-locallogin-dontaudit-sulogin_t.patch
diff mbox series

Patch

diff --git a/recipes-security/refpolicy/refpolicy/0063-policy-modules-system-locallogin-dontaudit-sulogin_t.patch b/recipes-security/refpolicy/refpolicy/0063-policy-modules-system-locallogin-dontaudit-sulogin_t.patch
new file mode 100644
index 0000000..252da0d
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0063-policy-modules-system-locallogin-dontaudit-sulogin_t.patch
@@ -0,0 +1,53 @@ 
+From cd5a50cb4ef1957cddc90d8ac2fd3bd5fbcde8d5 Mon Sep 17 00:00:00 2001
+From: Clayton Casciato <ccasciato@21sw.us>
+Date: Mon, 17 Mar 2025 20:09:55 -0600
+Subject: [PATCH] locallogin: dontaudit sulogin_t checkpoint_restore
+
+type=PROCTITLE proctitle=/usr/sbin/sulogin
+
+type=SYSCALL arch=armeb syscall=ioctl per=PER_LINUX success=yes exit=0
+a0=0x3 a1=0x5457 a2=0xbec20a90 a3=0xbec20a40 items=0 ppid=277 pid=278
+auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root
+sgid=root fsgid=root tty=ttyS0 ses=unset comm=sulogin
+exe=/usr/sbin/sulogin.util-linux subj=system_u:system_r:sulogin_t:s0
+key=(null)
+
+type=AVC avc:  denied  { checkpoint_restore } for  pid=278 comm=sulogin
+capability=checkpoint_restore  scontext=system_u:system_r:sulogin_t:s0
+tcontext=system_u:system_r:sulogin_t:s0 tclass=capability2
+
+--
+
+Ref: https://criu.org/Main_Page
+
+--
+
+Fedora:
+
+$ sesearch --dontaudit --source sulogin_t --target sulogin_t --class capability2
+dontaudit sulogin_t sulogin_t:capability2 checkpoint_restore;
+
+https://github.com/fedora-selinux/selinux-policy/commit/853dc2b6436ca5f2d7cb984bde3b000358829109
+https://bugzilla.redhat.com/show_bug.cgi?id=2265391
+
+Signed-off-by: Clayton Casciato <ccasciato@21sw.us>
+
+Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/79dda56d3191b09b9f0cbafd4d1bd7056fd3975e]
+
+Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
+---
+ policy/modules/system/locallogin.te | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
+index 4ba131d29..02c7ff56d 100644
+--- a/policy/modules/system/locallogin.te
++++ b/policy/modules/system/locallogin.te
+@@ -234,6 +234,7 @@ optional_policy(`
+ 
+ allow sulogin_t self:capability { dac_read_search sys_admin sys_tty_config };
+ dontaudit sulogin_t self:capability dac_override;
++dontaudit sulogin_t self:capability2 checkpoint_restore;
+ allow sulogin_t self:process setexec;
+ allow sulogin_t self:fd use;
+ allow sulogin_t self:fifo_file rw_fifo_file_perms;
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index c40d6e7..6a3e9eb 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -78,6 +78,7 @@  SRC_URI += " \
         file://0060-policy-modules-services-firewalld-fix-lib_t-python_c.patch \
         file://0061-policy-modules-services-firewalld-fix-firewalld_t-fi.patch \
         file://0062-policy-modules-multiple-filetrans-run_machine_id-etc.patch \
+        file://0063-policy-modules-system-locallogin-dontaudit-sulogin_t.patch \
         "
 
 S = "${WORKDIR}/refpolicy"