diff options
Diffstat (limited to 'recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch')
-rw-r--r-- | recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch b/recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch new file mode 100644 index 0000000..fb56eca --- /dev/null +++ b/recipes-security/refpolicy/refpolicy/0049-policy-modules-system-init-all-init_t-to-read-any-le.patch | |||
@@ -0,0 +1,40 @@ | |||
1 | From f3c0f18b647631fd2ffc1e86c9e3f51cbf74d60f Mon Sep 17 00:00:00 2001 | ||
2 | From: Wenzong Fan <wenzong.fan@windriver.com> | ||
3 | Date: Wed, 3 Feb 2016 04:16:06 -0500 | ||
4 | Subject: [PATCH] policy/modules/system/init: all init_t to read any level | ||
5 | sockets | ||
6 | |||
7 | Fixes: | ||
8 | avc: denied { listen } for pid=1 comm="systemd" \ | ||
9 | path="/run/systemd/journal/stdout" \ | ||
10 | scontext=system_u:system_r:init_t:s0-s15:c0.c1023 \ | ||
11 | tcontext=system_u:system_r:syslogd_t:s15:c0.c1023 \ | ||
12 | tclass=unix_stream_socket permissive=1 | ||
13 | |||
14 | systemd[1]: Failded to listen on Journal Socket | ||
15 | |||
16 | Upstream-Status: Inappropriate [embedded specific] | ||
17 | |||
18 | Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> | ||
19 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> | ||
20 | --- | ||
21 | policy/modules/system/init.te | 3 +++ | ||
22 | 1 file changed, 3 insertions(+) | ||
23 | |||
24 | diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te | ||
25 | index df7f87f17..671b5aef3 100644 | ||
26 | --- a/policy/modules/system/init.te | ||
27 | +++ b/policy/modules/system/init.te | ||
28 | @@ -234,6 +234,9 @@ mls_key_write_all_levels(init_t) | ||
29 | mls_file_downgrade(init_t) | ||
30 | mls_file_upgrade(init_t) | ||
31 | |||
32 | +# MLS trusted for reading from sockets at any level | ||
33 | +mls_socket_read_all_levels(init_t) | ||
34 | + | ||
35 | # the following one is needed for libselinux:is_selinux_enabled() | ||
36 | # otherwise the call fails and sysvinit tries to load the policy | ||
37 | # again when using the initramfs | ||
38 | -- | ||
39 | 2.25.1 | ||
40 | |||