| Message ID | f5bcd8a79a7056170c9c66855b032d44116490ee.1794472623.git.wenwfu@qti.qualcomm.com |
|---|---|
| State | New |
| Headers | show |
| Series | [meta-selinux,wrynose,v2] refpolicy: backport perf event access for unconfined domains | expand |
Merged Regards, Qi On 11/12/26 16:40, Wenwen Fu via yocto-patches wrote: > Unconfined domains lack the perf_event permissions needed by perf to > collect performance counters and tracepoints with SELinux enforcing. > > Backport refpolicy commit 6072cfa851a3 ("unconfined: allow perf event > access for unconfined domains") to allow unconfined domains to access > their own perf events. > > Apply the patch in refpolicy_common.inc because all refpolicy variants > use the unconfined module. > > Assisted-by: Codex:GPT-6 > Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> > --- > Changes in v2: > - Apply the patch in refpolicy_common.inc for all refpolicy variants, > as suggested by Chen Qi. > - Renumber the patch to 0059 and truncate its filename to 63 characters > to follow the shared patch naming convention. > - Update the commit message to describe the shared scope. > > ...-perf-event-access-for-unconfined-do.patch | 35 +++++++++++++++++++ > .../refpolicy/refpolicy_common.inc | 1 + > 2 files changed, 36 insertions(+) > create mode 100644 recipes-security/refpolicy/refpolicy/0059-unconfined-allow-perf-event-access-for-unconfined-do.patch > > diff --git a/recipes-security/refpolicy/refpolicy/0059-unconfined-allow-perf-event-access-for-unconfined-do.patch b/recipes-security/refpolicy/refpolicy/0059-unconfined-allow-perf-event-access-for-unconfined-do.patch > new file mode 100644 > index 0000000..a356218 > --- /dev/null > +++ b/recipes-security/refpolicy/refpolicy/0059-unconfined-allow-perf-event-access-for-unconfined-do.patch > @@ -0,0 +1,35 @@ > +From 6072cfa851a3598bfa86622dff9c680c2e662901 Mon Sep 17 00:00:00 2001 > +From: Wenwen Fu <wenwfu@qti.qualcomm.com> > +Date: Thu, 5 Nov 2026 10:02:03 +0800 > +Subject: [PATCH] unconfined: allow perf event access for unconfined domains > + > +Unconfined domains have the perfmon capability but lack complete > +perf_event permissions. This prevents perf from collecting performance > +counters and tracepoints with SELinux enforcing. > + > +Allow unconfined domains to open, read and control their own perf > +events, including CPU, kernel and tracepoint collection. Add the rule > +to unconfined_domain_noaudit() alongside the other self access rules. > + > +Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/6072cfa851a3598bfa86622dff9c680c2e662901] > + > +Assisted-by: Codex:GPT-6 > +Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> > +--- > + policy/modules/system/unconfined.if | 3 +++ > + 1 file changed, 3 insertions(+) > + > +diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if > +index 6c48561238..c627d38dcf 100644 > +--- a/policy/modules/system/unconfined.if > ++++ b/policy/modules/system/unconfined.if > +@@ -59,6 +59,9 @@ interface(`unconfined_domain_noaudit',` > + # for io_uring > + allow $1 self:anon_inode { create map read write }; > + > ++ # Access own perf events > ++ allow $1 self:perf_event { open cpu kernel tracepoint read write }; > ++ > + # Userland object managers > + allow $1 self:nscd { admin getgrp gethost getpwd getserv getstat shmemgrp shmemhost shmempwd shmemserv }; > + allow $1 self:dbus { acquire_svc send_msg }; > diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc > index 014714c..d896d88 100644 > --- a/recipes-security/refpolicy/refpolicy_common.inc > +++ b/recipes-security/refpolicy/refpolicy_common.inc > @@ -74,6 +74,7 @@ SRC_URI += " \ > file://0056-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \ > file://0057-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \ > file://0058-policy-modules-system-logging-make-syslogd_runtime_t.patch \ > + file://0059-unconfined-allow-perf-event-access-for-unconfined-do.patch \ > " > > S = "${UNPACKDIR}/refpolicy"
diff --git a/recipes-security/refpolicy/refpolicy/0059-unconfined-allow-perf-event-access-for-unconfined-do.patch b/recipes-security/refpolicy/refpolicy/0059-unconfined-allow-perf-event-access-for-unconfined-do.patch new file mode 100644 index 0000000..a356218 --- /dev/null +++ b/recipes-security/refpolicy/refpolicy/0059-unconfined-allow-perf-event-access-for-unconfined-do.patch @@ -0,0 +1,35 @@ +From 6072cfa851a3598bfa86622dff9c680c2e662901 Mon Sep 17 00:00:00 2001 +From: Wenwen Fu <wenwfu@qti.qualcomm.com> +Date: Thu, 5 Nov 2026 10:02:03 +0800 +Subject: [PATCH] unconfined: allow perf event access for unconfined domains + +Unconfined domains have the perfmon capability but lack complete +perf_event permissions. This prevents perf from collecting performance +counters and tracepoints with SELinux enforcing. + +Allow unconfined domains to open, read and control their own perf +events, including CPU, kernel and tracepoint collection. Add the rule +to unconfined_domain_noaudit() alongside the other self access rules. + +Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/6072cfa851a3598bfa86622dff9c680c2e662901] + +Assisted-by: Codex:GPT-6 +Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> +--- + policy/modules/system/unconfined.if | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if +index 6c48561238..c627d38dcf 100644 +--- a/policy/modules/system/unconfined.if ++++ b/policy/modules/system/unconfined.if +@@ -59,6 +59,9 @@ interface(`unconfined_domain_noaudit',` + # for io_uring + allow $1 self:anon_inode { create map read write }; + ++ # Access own perf events ++ allow $1 self:perf_event { open cpu kernel tracepoint read write }; ++ + # Userland object managers + allow $1 self:nscd { admin getgrp gethost getpwd getserv getstat shmemgrp shmemhost shmempwd shmemserv }; + allow $1 self:dbus { acquire_svc send_msg }; diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc index 014714c..d896d88 100644 --- a/recipes-security/refpolicy/refpolicy_common.inc +++ b/recipes-security/refpolicy/refpolicy_common.inc @@ -74,6 +74,7 @@ SRC_URI += " \ file://0056-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \ file://0057-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \ file://0058-policy-modules-system-logging-make-syslogd_runtime_t.patch \ + file://0059-unconfined-allow-perf-event-access-for-unconfined-do.patch \ " S = "${UNPACKDIR}/refpolicy"
Unconfined domains lack the perf_event permissions needed by perf to collect performance counters and tracepoints with SELinux enforcing. Backport refpolicy commit 6072cfa851a3 ("unconfined: allow perf event access for unconfined domains") to allow unconfined domains to access their own perf events. Apply the patch in refpolicy_common.inc because all refpolicy variants use the unconfined module. Assisted-by: Codex:GPT-6 Signed-off-by: Wenwen Fu <wenwfu@qti.qualcomm.com> --- Changes in v2: - Apply the patch in refpolicy_common.inc for all refpolicy variants, as suggested by Chen Qi. - Renumber the patch to 0059 and truncate its filename to 63 characters to follow the shared patch naming convention. - Update the commit message to describe the shared scope. ...-perf-event-access-for-unconfined-do.patch | 35 +++++++++++++++++++ .../refpolicy/refpolicy_common.inc | 1 + 2 files changed, 36 insertions(+) create mode 100644 recipes-security/refpolicy/refpolicy/0059-unconfined-allow-perf-event-access-for-unconfined-do.patch