From 2f8ab7cae0d92f20668b8c893f134c9a4d4890f5 Mon Sep 17 00:00:00 2001 From: Clayton Casciato Date: Mon, 10 Mar 2025 07:15:51 -0600 Subject: [PATCH] refpolicy: authlogin - allow unix_chkpwd to run Signed-off-by: Clayton Casciato Signed-off-by: Yi Zhao --- ...ystem-authlogin-chkpwd_t-dac_read_se.patch | 30 +++++++++++++++++++ .../refpolicy/refpolicy_common.inc | 1 + 2 files changed, 31 insertions(+) create mode 100644 recipes-security/refpolicy/refpolicy/0057-policy-modules-system-authlogin-chkpwd_t-dac_read_se.patch diff --git a/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-authlogin-chkpwd_t-dac_read_se.patch b/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-authlogin-chkpwd_t-dac_read_se.patch new file mode 100644 index 0000000..9155c85 --- /dev/null +++ b/recipes-security/refpolicy/refpolicy/0057-policy-modules-system-authlogin-chkpwd_t-dac_read_se.patch @@ -0,0 +1,30 @@ +From 390fc1607c9c9f7e79adc74386d8503a7c9bf9cf Mon Sep 17 00:00:00 2001 +From: Tianjia Zhang +Date: Mon, 30 Dec 2024 15:58:17 +0800 +Subject: authlogin: allow unix_chkpwd to run + +denied { dac_read_search } for pid=27506 comm="unix_chkpwd" capability=2 scontext=system_u:system_r:chkpwd_t:s0-s15:c0.c1023 tcontext=system_u:system_r:chkpwd_t:s0-s15:c0.c1023 tclass=capability permissive=1 + +Signed-off-by: Tianjia Zhang + +Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/796d0335f6b975c9d075525d62ec8e854ce5beef] + +Signed-off-by: Clayton Casciato + +--- + policy/modules/system/authlogin.te | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te +index f33a8095f..3c3740dc4 100644 +--- a/policy/modules/system/authlogin.te ++++ b/policy/modules/system/authlogin.te +@@ -109,7 +109,7 @@ optional_policy(` + # Check password local policy + # + +-allow chkpwd_t self:capability { dac_override setuid }; ++allow chkpwd_t self:capability { dac_override dac_read_search setuid }; + dontaudit chkpwd_t self:capability sys_tty_config; + allow chkpwd_t self:process { getattr signal }; + dontaudit chkpwd_t self:process getcap; diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc index f8e5f10..0c3966d 100644 --- a/recipes-security/refpolicy/refpolicy_common.inc +++ b/recipes-security/refpolicy/refpolicy_common.inc @@ -72,6 +72,7 @@ SRC_URI += " \ file://0054-policy-modules-system-setrans-allow-setrans_t-use-fd.patch \ file://0055-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \ file://0056-policy-modules-system-logging-make-syslogd_runtime_t.patch \ + file://0057-policy-modules-system-authlogin-chkpwd_t-dac_read_se.patch \ " S = "${WORKDIR}/refpolicy"