Petr Lautrbach e0813db519 newrole: allow newrole to use setcap to drop capabilities ... Commit 61b72e0796 ("selinuxutil: adjustments") removed negative permission matching for newrole_t:process. One of the removed permission was setcap which is needed by newrole as it tries to drop capabilities: $ newrole -r sysadm_r Sorry, newrole failed to drop capabilities : Permission denied type=PROCTITLE msg=audit(09/06/2019 15:07:01.908:10821) : proctitle=newrole -r sysadm_r type=SYSCALL msg=audit(09/06/2019 15:07:01.908:10821) : arch=x86_64 syscall=capset success=no exit=EACCES(Permission denied) a0=0x7fbe17d4cb6c a1=0x7fbe17d4cb74 a2=0x7fbe17d4d5d0 a3=0x0 items=0 ppid=4981 pid=7255 auid=admin uid=admin gid=admin euid=admin suid=admin fsuid=admin egid=admin sgid=admin fsgid=admin tty=tty1 ses=6 comm=newrole exe=/usr/bin/newrole subj=staff_u:staff_r:newrole_t:s0 key=(null) type=AVC msg=audit(09/06/2019 15:07:01.908:10821) : avc: denied { setcap } for pid=7255 comm=newrole scontext=staff_u:staff_r:newrole_t:s0 tcontext=staff_u:staff_r:newrole_t:s0 tclass=process permissive=0 Signed-off-by: Petr Lautrbach <plautrba@redhat.com>		2019-09-18 15:34:29 +02:00
..
flask	Remove incorrect comment about capability2:mac_admin.	2019-03-11 20:49:42 -04:00
modules	newrole: allow newrole to use setcap to drop capabilities	2019-09-18 15:34:29 +02:00
support
constraints
context_defaults
global_booleans
global_tunables
mcs
mls
policy_capabilities
users