diff --git a/recipes-security/refpolicy/refpolicy/0065-policy-modules-system-systemd-allow-systemd_logind_t.patch b/recipes-security/refpolicy/refpolicy/0065-policy-modules-system-systemd-allow-systemd_logind_t.patch new file mode 100644 index 0000000..be1cddc --- /dev/null +++ b/recipes-security/refpolicy/refpolicy/0065-policy-modules-system-systemd-allow-systemd_logind_t.patch @@ -0,0 +1,56 @@ +From f76099508c56db31fdc331e844d4e5b574b3206b Mon Sep 17 00:00:00 2001 +From: Clayton Casciato +Date: Tue, 8 Jul 2025 17:06:19 -0600 +Subject: [PATCH] systemd: allow systemd_logind_t unconfined_t:fd use + +"sudo su -" + +-- + +type=PROCTITLE proctitle=/usr/lib/systemd/systemd-logind + +type=SYSCALL arch=armeb syscall=recvmsg per=PER_LINUX success=yes +exit=24 a0=0xe a1=0xbee507e4 a2=MSG_DONTWAIT|MSG_CMSG_CLOEXEC a3=0x1 +items=0 ppid=1 pid=186 auid=unset uid=root gid=root euid=root suid=root +fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset +comm=systemd-logind exe=/usr/lib/systemd/systemd-logind +subj=system_u:system_r:systemd_logind_t:s0 key=(null) + +type=AVC avc: denied { use } for pid=186 comm=systemd-logind +path=anon_inode:[pidfd] dev="pidfs" ino=311 +scontext=system_u:system_r:systemd_logind_t:s0 +tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=fd + +-- + +Fedora: + +$ sesearch -A --source systemd_logind_t --target unconfined_t --class fd --perm use +allow daemon initrc_transition_domain:fd use; +allow domain domain:fd use; [ domain_fd_use ]:True +allow domain unconfined_t:fd use; + +$ getsebool domain_fd_use +domain_fd_use --> on + +Signed-off-by: Clayton Casciato + +Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/a742066011070c6696eda00442a46d1e9970a614] + +Signed-off-by: Clayton Casciato +--- + policy/modules/system/systemd.te | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te +index 514ead9a8..2b2f43f36 100644 +--- a/policy/modules/system/systemd.te ++++ b/policy/modules/system/systemd.te +@@ -1172,6 +1172,7 @@ optional_policy(` + + optional_policy(` + unconfined_dbus_send(systemd_logind_t) ++ unconfined_use_fds(systemd_logind_t) + ') + + ######################################### diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc index 9d729df..33c3f32 100644 --- a/recipes-security/refpolicy/refpolicy_common.inc +++ b/recipes-security/refpolicy/refpolicy_common.inc @@ -80,6 +80,7 @@ SRC_URI += " \ file://0062-policy-modules-services-ssh-allow-sshd_t-kernel_t-sy.patch \ file://0063-policy-modules-services-ssh-allow-sshd_t-userdomain-.patch \ file://0064-policy-modules-services-dbus-allow-system_dbusd_t-un.patch \ + file://0065-policy-modules-system-systemd-allow-systemd_logind_t.patch \ " S = "${WORKDIR}/refpolicy"