Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Sd rfkill bpf #1529

Merged
merged 2 commits into from
Dec 19, 2022
Merged

Sd rfkill bpf #1529

merged 2 commits into from
Dec 19, 2022

Commits on Dec 19, 2022

  1. Allow systemd-rfkill the bpf capability 

    Linux Socket Filtering (LSF) is derived from the Berkeley Packet Filter
and uses the same mechanism to allow a user-space program to attach a
filter onto any socket and allow or disallow certain types of data to
come through the socket.
The systemd-rfkill service wants to listen only to related udev events,
so it needs to set a filter for which the bpf capability is required.

Addresses the following USER_AVC denial:
type=AVC msg=audit(1669160827.102:10): avc:  denied  { bpf } for  pid=954 comm="systemd-rfkill" capability=39  scontext=system_u:system_r:systemd_rfkill_t:s0 tcontext=system_u:system_r:systemd_rfkill_t:s0 tclass=capability2 permissive=0

Resolves: rhbz#2149390
    @zpytela
    zpytela committed Dec 19, 2022
    Configuration menu
    Copy the full SHA
    9ef4179 View commit details
    Browse the repository at this point in the history

  2. Allow NetworkManager and wpa_supplicant the bpf capability 

    Linux Socket Filtering (LSF) is derived from the Berkeley Packet Filter
and uses the same mechanism to allow a user-space program to attach a
filter onto any socket and allow or disallow certain types of data to
come through the socket.
Both NetworkManager and wpa_supplicant, running in the same domain,
want to listen only to related network events, so they need to set
a filter for which the bpf capability is required.

Addresses the following AVC denial:
type=PROCTITLE msg=audit(10/23/2022 19:29:47.030:1673) : proctitle=/usr/sbin/wpa_supplicant -c /etc/wpa_supplicant/wpa_supplicant.conf -u -s
type=AVC msg=audit(10/23/2022 19:29:47.030:1673) : avc:  denied  { bpf } for  pid=1637 comm=wpa_supplicant capability=bpf  scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:system_r:NetworkManager_t:s0 tclass=capability2 permissive=0
type=SYSCALL msg=audit(10/23/2022 19:29:47.030:1673) : arch=x86_64 syscall=setsockopt success=yes exit=0 a0=0xc a1=SOL_SOCKET a2=SO_ATTACH_FILTER a3=0x55f15ed093a0 items=0 ppid=1 pid=1637 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=wpa_supplicant exe=/usr/sbin/wpa_supplicant subj=system_u:system_r:NetworkManager_t:s0 key=(null)

Resolves: rhbz#2137085
    @zpytela
    zpytela committed Dec 19, 2022
    Configuration menu
    Copy the full SHA
    cca4279 View commit details
    Browse the repository at this point in the history