mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

selinux: Drop user_namespace class rules for Fedora 37

Browse source 
With current selinux-policy-37.22-1.fc37.noarch, and presumably any
future update for Fedora 37, the user_namespace class is not
available, so statements using it prevent the policy from being
loaded.

If a class is not defined in the base policy, any related permission
is assumed to be enabled, so we can safely drop those.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=2237996
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Stefano Brivio 2023-10-09 23:04:47 +02:00
parent f851084c96
commit 3fb3f0f7a5
2 changed files with 0 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
contrib/selinux/passt.te
View file

@ -53,7 +53,6 @@ require {
class capability { sys_tty_config setuid setgid }; class capability { sys_tty_config setuid setgid };
class cap_userns { setpcap sys_admin sys_ptrace }; class cap_userns { setpcap sys_admin sys_ptrace };
class user_namespace create;
} }
type passt_t; type passt_t;
@ -93,7 +92,6 @@ allow syslogd_t self:cap_userns sys_ptrace;
allow passt_t self:process setcap; allow passt_t self:process setcap;
allow passt_t self:capability { sys_tty_config setpcap net_bind_service setuid setgid}; allow passt_t self:capability { sys_tty_config setpcap net_bind_service setuid setgid};
allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace }; allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace };
allow passt_t self:user_namespace create;
allow passt_t passwd_file_t:file read_file_perms; allow passt_t passwd_file_t:file read_file_perms;
sssd_search_lib(passt_t) sssd_search_lib(passt_t)

2
contrib/selinux/pasta.te
View file

@ -88,7 +88,6 @@ require {
class capability { sys_tty_config setuid setgid }; class capability { sys_tty_config setuid setgid };
class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin }; class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin };
class user_namespace create;
} }
type pasta_t; type pasta_t;
@ -113,7 +112,6 @@ init_daemon_domain(pasta_t, pasta_exec_t)
allow pasta_t self:capability { setpcap net_bind_service sys_tty_config dac_read_search net_admin sys_resource setuid setgid }; allow pasta_t self:capability { setpcap net_bind_service sys_tty_config dac_read_search net_admin sys_resource setuid setgid };
allow pasta_t self:cap_userns { setpcap sys_admin sys_ptrace net_admin net_bind_service }; allow pasta_t self:cap_userns { setpcap sys_admin sys_ptrace net_admin net_bind_service };
allow pasta_t self:user_namespace create;
allow pasta_t passwd_file_t:file read_file_perms; allow pasta_t passwd_file_t:file read_file_perms;
sssd_search_lib(pasta_t) sssd_search_lib(pasta_t)