diff options
| author | Clayton Casciato <majortomtosourcecontrol@gmail.com> | 2026-01-10 08:27:36 -0700 |
|---|---|---|
| committer | Scott Murray <scott.murray@konsulko.com> | 2026-01-18 16:48:45 +0200 |
| commit | 252f97af420cd170c37f3c33c2c1e86afeaa25f5 (patch) | |
| tree | a2f53349cc494908bb6090bc083db641a0886432 /classes/dm-verity-img.bbclass | |
| parent | 0a448b7bc73b26aeb659bc1fdd4c90049d7d51bb (diff) | |
| download | meta-security-252f97af420cd170c37f3c33c2c1e86afeaa25f5.tar.gz | |
suricata: add PACKAGECONFIG[seccomp] - MemoryDenyWriteExecute
Add option to prevent memory mappings that are both writable and
executable.
https://www.freedesktop.org/software/systemd/man/255/systemd.exec.html#MemoryDenyWriteExecute=
Core Suricata developer:
https://github.com/jasonish/suricata-rpms/blob/a606a810325dd0a4f3ee45b2756b96bda28e590b/7.0/suricata-4.1.1-service.patch#L23
Fedora:
https://src.fedoraproject.org/rpms/suricata/c/cfb3b996f54d28018cd01f9c6b9ecb77e59f344d
Resolve SELinux AVC denial:
type=PROCTITLE proctitle=/usr/bin/suricata
-c /etc/suricata/suricata.yaml -i eth0
type=SYSCALL arch=aarch64 syscall=mprotect success=no
exit=EACCES(Permission denied) a0=0x7fffa7d04000 a1=0x4000
a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=0x21 items=0 ppid=1 pid=283
auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root
sgid=root fsgid=root tty=(none) ses=unset comm=Suricata-Main
exe=/usr/bin/suricata subj=system_u:system_r:initrc_t:s0 key=(null)
type=AVC avc: denied { execmem } for pid=283 comm=Suricata-Main
scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=process
Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Diffstat (limited to 'classes/dm-verity-img.bbclass')
0 files changed, 0 insertions, 0 deletions