CaROS/meta-selinux
3
0
Fork 0
mirror of git://git.yoctoproject.org/meta-selinux synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

refpolicy: locallogin - allow sulogin_t unconfined domtrans

Browse Source 
Signed-off-by: Clayton Casciato <majortomtosourecontrol@gmail.com>
This commit is contained in:
Clayton Casciato 2025-04-08 08:34:02 -06:00 committed by Yi Zhao
parent dfe98ef7aa
commit 9429eccf03
2 changed files with 82 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
recipes-security/refpolicy/refpolicy/0064-policy-modules-system-locallogin-allow-sulogin_t-unc.patch Normal file
View File

@ -0,0 +1,81 @@
From 43dcc59a402353f79acfd9247daafe3e9fa0d13f Mon Sep 17 00:00:00 2001
From: Clayton Casciato <ccasciato@21sw.us>
Date: Tue, 18 Mar 2025 12:49:43 -0600
Subject: [PATCH] locallogin: allow sulogin_t unconfined domtrans
type=PROCTITLE proctitle=/usr/sbin/sulogin
type=PATH item=0 name=/usr/lib/ld-linux-armhf.so.3 inode=1956 dev=b3:32
mode=file,755 ouid=root ogid=root rdev=00:00
obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=none cap_fi=none
cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD cwd=/root
type=EXECVE argc=1 a0=sh
type=SYSCALL arch=armeb syscall=execve per=PER_LINUX success=yes exit=0
a0=0x43032e a1=0xbec21aa8 a2=0x431760 a3=0xb6f61df0 items=1 ppid=352
pid=353 auid=unset uid=root gid=root euid=root suid=root fsuid=root
egid=root sgid=root fsgid=root tty=ttyS0 ses=unset comm=sh
exe=/usr/bin/bash.bash subj=unconfined_u:unconfined_r:unconfined_t:s0
key=(null)
type=AVC avc: denied { siginh } for pid=353 comm=sh
scontext=system_u:system_r:sulogin_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
type=AVC avc: denied { rlimitinh } for pid=353 comm=sh
scontext=system_u:system_r:sulogin_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
type=AVC avc: denied { noatsecure } for pid=353 comm=sulogin
scontext=system_u:system_r:sulogin_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
type=AVC avc: denied { transition } for pid=353 comm=sulogin
path=/usr/bin/bash.bash dev="mmcblk0p2" ino=689
scontext=system_u:system_r:sulogin_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process
--
Similar policy:
https://github.com/SELinuxProject/refpolicy/blob/RELEASE_2_20250213/policy/modules/services/cockpit.te#L222
--
Fedora:
$ sesearch -A --source sulogin_t --target unconfined_t --class process
allow domain unconfined_t:process sigchld;
allow unconfined_login_domain unconfined_t:process transition;
[ unconfined_login ]:True
$ getsebool -a | grep unconfined_login
unconfined_login --> on
https://github.com/fedora-selinux/selinux-policy/blob/v41.34/policy/modules/system/locallogin.te#L277
Signed-off-by: Clayton Casciato <ccasciato@21sw.us>
Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/ec2b2befdd9f3760b6afcc4ec45a4c07e78e2932]
Signed-off-by: Clayton Casciato <majortomtosourecontrol@gmail.com>
---
policy/modules/system/locallogin.te | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
index 02c7ff56d..fcec23010 100644
--- a/policy/modules/system/locallogin.te
+++ b/policy/modules/system/locallogin.te
@@ -298,3 +298,7 @@ optional_policy(`
optional_policy(`
nscd_use(sulogin_t)
')
+
+optional_policy(`
+ unconfined_domtrans(sulogin_t)
+')

1
recipes-security/refpolicy/refpolicy_common.inc
View File

@ -79,6 +79,7 @@ SRC_URI += " \
file://0061-policy-modules-services-firewalld-fix-firewalld_t-fi.patch \
file://0062-policy-modules-multiple-filetrans-run_machine_id-etc.patch \
file://0063-policy-modules-system-locallogin-dontaudit-sulogin_t.patch \
file://0064-policy-modules-system-locallogin-allow-sulogin_t-unc.patch \
"
S = "${WORKDIR}/refpolicy"