nnd
/
selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

minissdpd: Revoke kernel module loading permissions. 

This domain also calls kernel_request_load_module(), which should be
sufficent.

Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
This commit is contained in:
Chris PeBenito 2024-02-29 09:53:18 -05:00
parent 5671390e2c
commit 1c20c002cd
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
policy/modules/services/minissdpd.te
View File

@ -23,7 +23,7 @@ files_runtime_file(minissdpd_runtime_t)
# Local policy
#
allow minissdpd_t self:capability { net_admin sys_module };
allow minissdpd_t self:capability net_admin;
allow minissdpd_t self:netlink_route_socket r_netlink_socket_perms;
allow minissdpd_t self:udp_socket create_socket_perms;
allow minissdpd_t self:unix_dgram_socket create_socket_perms;
@ -33,7 +33,6 @@ allow minissdpd_t minissdpd_runtime_t:file manage_file_perms;
allow minissdpd_t minissdpd_runtime_t:sock_file manage_sock_file_perms;
files_runtime_filetrans(minissdpd_t, minissdpd_runtime_t, { file sock_file })
kernel_load_module(minissdpd_t)
kernel_read_network_state(minissdpd_t)
kernel_request_load_module(minissdpd_t)