From 71bcdcc9436fe4dd81c5b1c569bdb70dd175c423 Mon Sep 17 00:00:00 2001 From: Richard Haines Date: Fri, 25 Feb 2022 17:55:49 +0000 Subject: [PATCH] libsepol: Add 'ioctl_skip_cloexec' policy capability If 'ioctl_skip_cloexec' set, kernel will always allow FIOCLEX and FIONCLEX ioctls. Signed-off-by: Richard Haines --- libsepol/include/sepol/policydb/polcaps.h | 1 + libsepol/src/polcaps.c | 1 + 2 files changed, 2 insertions(+) diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h index 40669fb5..39c99839 100644 --- a/libsepol/include/sepol/policydb/polcaps.h +++ b/libsepol/include/sepol/policydb/polcaps.h @@ -14,6 +14,7 @@ enum { POLICYDB_CAPABILITY_CGROUPSECLABEL, POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION, POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS, + POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC, __POLICYDB_CAPABILITY_MAX }; #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1) diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c index 6a74ec7d..a5e515f2 100644 --- a/libsepol/src/polcaps.c +++ b/libsepol/src/polcaps.c @@ -13,6 +13,7 @@ static const char * const polcap_names[] = { "cgroup_seclabel", /* POLICYDB_CAPABILITY_SECLABEL */ "nnp_nosuid_transition", /* POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION */ "genfs_seclabel_symlinks", /* POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS */ + "ioctl_skip_cloexec", /* POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC */ NULL };