blob: f7758c5d818e7ea4c8bc895649e98d510b2a5886 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
From 2d932ba7140d91cf2a8386b0240f4f1014124746 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Wed, 3 Feb 2021 09:47:59 +0800
Subject: [PATCH] policy/modules/system/init: add capability2 bpf and perfmon
for init_t
Fixes:
avc: denied { bpf } for pid=1 comm="systemd" capability=39
scontext=system_u:system_r:init_t tcontext=system_u:system_r:init_t
tclass=capability2 permissive=0
avc: denied { perfmon } for pid=1 comm="systemd" capability=38
scontext=system_u:system_r:init_t tcontext=system_u:system_r:init_t
tclass=capability2 permissive=0
Upstream-Status: Inappropriate [embedded specific]
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
policy/modules/system/init.te | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index e82177938..b7d494398 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -134,7 +134,7 @@ ifdef(`enable_mls',`
# Use capabilities. old rule:
allow init_t self:capability { chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap };
-allow init_t self:capability2 { wake_alarm block_suspend };
+allow init_t self:capability2 { wake_alarm block_suspend bpf perfmon };
# is ~sys_module really needed? observed:
# sys_boot
# sys_tty_config
--
2.17.1
|
