From ab13c04211ee14d6f6cdbddb4a772571b9211b1a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= Date: Thu, 28 Mar 2024 20:01:49 +0100 Subject: [PATCH 1/2] getty: grant checkpoint_restore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since Linux 6.7 checkpoint-restore functionality is guareded via the capability CAP_CHECKPOINT_RESTORE, with a fallback to CAP_SYS_ADMIN. Grant the new capability while keeping the old one for backwards compatibility. Signed-off-by: Christian Göttsche --- policy/modules/system/getty.te | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te index bbc83a807..a900226bf 100644 --- a/policy/modules/system/getty.te +++ b/policy/modules/system/getty.te @@ -34,6 +34,7 @@ files_tmp_file(getty_tmp_t) # Use capabilities. allow getty_t self:capability { chown dac_override fowner fsetid setgid sys_admin sys_resource sys_tty_config }; dontaudit getty_t self:capability sys_tty_config; +allow getty_t self:capability2 checkpoint_restore; allow getty_t self:process { getpgid getsession setpgid signal_perms }; allow getty_t self:fifo_file rw_fifo_file_perms; From 0aff1990e19be12993488cf5a4f096b521b7dbf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= Date: Thu, 28 Mar 2024 20:02:47 +0100 Subject: [PATCH 2/2] quote: read localization MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit AVC avc: denied { map } for pid=581 comm="quotaon" path="/usr/lib/locale/locale-archive" dev="vda1" ino=392093 scontext=system_u:system_r:quota_t:s0 tcontext=unconfined_u:object_r:locale_t:s0 tclass=file permissive=0 Signed-off-by: Christian Göttsche --- policy/modules/admin/quota.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/admin/quota.te b/policy/modules/admin/quota.te index aa6bed829..b3bceaef9 100644 --- a/policy/modules/admin/quota.te +++ b/policy/modules/admin/quota.te @@ -72,6 +72,8 @@ fs_getattr_xattr_fs(quota_t) fs_remount_xattr_fs(quota_t) fs_search_auto_mountpoints(quota_t) +miscfiles_read_localization(quota_t) + mls_file_read_all_levels(quota_t) storage_raw_read_fixed_disk(quota_t)