commit: 2742ffe56eb2a1943c6ddbbd47071a6fa5437875
Author: Christian Göttsche <cgzones <AT> googlemail <DOT> com>
AuthorDate: Thu Feb 22 17:00:40 2024 +0000
Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Fri Mar 1 17:05:44 2024 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=2742ffe5
selinuxutil: setfiles updates
type=PROCTITLE msg=audit(21/02/24 22:31:50.044:122) : proctitle=restorecon
-vRn -T0 /
type=SYSCALL msg=audit(21/02/24 22:31:50.044:122) : arch=x86_64
syscall=sched_getaffinity success=yes exit=8 a0=0x0 a1=0x1000 a2=0x7fc235649bf0
a3=0x0 items=0 ppid=1103 pid=13398 auid=root uid=root gid=root euid=root
suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1 ses=1
comm=restorecon exe=/usr/sbin/setfiles
subj=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(21/02/24 22:31:50.044:122) : avc: denied { getsched }
for pid=13398 comm=restorecon
scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 tclass=process
permissive=1
type=PROCTITLE msg=audit(21/02/24 22:31:55.040:123) : proctitle=restorecon
-vRn -T0 /
type=PATH msg=audit(21/02/24 22:31:55.040:123) : item=0
name=/sys/fs/cgroup/user.slice/user-0.slice/user <AT> 0.service/memory.pressure
inode=2455 dev=00:1b mode=file,644 ouid=root ogid=root rdev=00:00
obj=system_u:object_r:memory_pressure_t:s0 nametype=NORMAL cap_fp=none
cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(21/02/24 22:31:55.040:123) :
cwd=/root/workspace/selinux/refpolicy/refpolicy
type=SYSCALL msg=audit(21/02/24 22:31:55.040:123) : arch=x86_64
syscall=newfstatat success=yes exit=0 a0=AT_FDCWD a1=0x557264466530
a2=0x7fc2004cacc0 a3=0x100 items=1 ppid=1103 pid=13398 auid=root uid=root
gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1
ses=1 comm=restorecon exe=/usr/sbin/setfiles
subj=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(21/02/24 22:31:55.040:123) : avc: denied { getattr }
for pid=13398 comm=restorecon path=/sys/fs/cgroup/user.slice/user-0.slice/user
<AT> 0.service/memory.pressure dev="cgroup2" ino=2455
scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023
tcontext=system_u:object_r:memory_pressure_t:s0 tclass=file permissive=1
type=PROCTITLE msg=audit(21/02/24 22:32:15.512:126) : proctitle=restorecon
-vRFn -T0 /usr/
type=PATH msg=audit(21/02/24 22:32:15.512:126) : item=0
name=/proc/sys/vm/overcommit_memory inode=41106 dev=00:16 mode=file,644
ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysctl_vm_overcommit_t:s0
nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(21/02/24 22:32:15.512:126) :
cwd=/root/workspace/selinux/refpolicy/refpolicy
type=SYSCALL msg=audit(21/02/24 22:32:15.512:126) : arch=x86_64
syscall=openat success=yes exit=3 a0=AT_FDCWD a1=0x7f59f7316810
a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1103 pid=13491 auid=root uid=root
gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1
ses=1 comm=restorecon exe=/usr/sbin/setfiles
subj=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(21/02/24 22:32:15.512:126) : avc: denied { open } for
pid=13491 comm=restorecon path=/proc/sys/vm/overcommit_memory dev="proc"
ino=41106 scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sysctl_vm_overcommit_t:s0 tclass=file permissive=1
type=AVC msg=audit(21/02/24 22:32:15.512:126) : avc: denied { read } for
pid=13491 comm=restorecon name=overcommit_memory dev="proc" ino=41106
scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sysctl_vm_overcommit_t:s0 tclass=file permissive=1
Signed-off-by: Christian Göttsche <cgzones <AT> googlemail.com>
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>
policy/modules/kernel/filesystem.if | 18 ++++++++++++++++++
policy/modules/system/selinuxutil.te | 3 +++
2 files changed, 21 insertions(+)
diff --git a/policy/modules/kernel/filesystem.if
b/policy/modules/kernel/filesystem.if
index e529b187f..08ad5503d 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -1271,6 +1271,24 @@ interface(`fs_cgroup_filetrans_memory_pressure',`
fs_cgroup_filetrans($1, memory_pressure_t, $2, $3)
')
+########################################
+## <summary>
+## Get the attributes of cgroup's memory.pressure files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`fs_getattr_memory_pressure',`
+ gen_require(`
+ type memory_pressure_t;
+ ')
+
+ allow $1 memory_pressure_t:file getattr;
+')
+
########################################
## <summary>
## Allow managing a cgroup's memory.pressure file to get notifications
diff --git a/policy/modules/system/selinuxutil.te
b/policy/modules/system/selinuxutil.te
index 82130ecd0..b1213aa76 100644
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -599,6 +599,7 @@ optional_policy(`
allow setfiles_t self:capability { dac_override dac_read_search fowner };
dontaudit setfiles_t self:capability sys_tty_config;
+allow setfiles_t self:process getsched;
allow setfiles_t self:fifo_file rw_fifo_file_perms;
allow setfiles_t { policy_src_t policy_config_t file_context_t
default_context_t }:dir list_dir_perms;
@@ -621,6 +622,7 @@ kernel_dontaudit_list_all_proc(setfiles_t)
kernel_dontaudit_list_all_sysctls(setfiles_t)
kernel_getattr_debugfs(setfiles_t)
kernel_read_kernel_sysctls(setfiles_t)
+kernel_read_vm_overcommit_sysctl(setfiles_t)
kernel_dontaudit_getattr_proc(setfiles_t)
dev_read_urand(setfiles_t)
@@ -640,6 +642,7 @@ files_dontaudit_read_all_symlinks(setfiles_t)
fs_getattr_all_xattr_fs(setfiles_t)
fs_getattr_cgroup(setfiles_t)
+fs_getattr_memory_pressure(setfiles_t)
fs_getattr_nfs(setfiles_t)
fs_getattr_pstore_dirs(setfiles_t)
fs_getattr_pstorefs(setfiles_t)
