From b662a4d873284f367ae70fcacfa623b2bc272fac Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Tue, 23 Apr 2024 09:18:11 -0400 Subject: [PATCH] selinux-policy: Add checkpoint restore for getty. Patch cherry-picked from upstream. Fixes new issue seen in SELinux BVT. Signed-off-by: Chris PeBenito --- .../0042-getty-grant-checkpoint_restore.patch | 33 +++++++++++++++++++ SPECS/selinux-policy/selinux-policy.spec | 6 +++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 SPECS/selinux-policy/0042-getty-grant-checkpoint_restore.patch diff --git a/SPECS/selinux-policy/0042-getty-grant-checkpoint_restore.patch b/SPECS/selinux-policy/0042-getty-grant-checkpoint_restore.patch new file mode 100644 index 00000000000..da7e0701042 --- /dev/null +++ b/SPECS/selinux-policy/0042-getty-grant-checkpoint_restore.patch @@ -0,0 +1,33 @@ +From 46192c98e771f5120b62c6ab36dc1245424e7cd4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= +Date: Thu, 28 Mar 2024 20:01:49 +0100 +Subject: [PATCH 41/41] getty: grant checkpoint_restore +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Since Linux 6.7 checkpoint-restore functionality is guareded via the +capability CAP_CHECKPOINT_RESTORE, with a fallback to CAP_SYS_ADMIN. +Grant the new capability while keeping the old one for backwards +compatibility. + +Signed-off-by: Christian Göttsche +--- + policy/modules/system/getty.te | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te +index bbc83a807..a900226bf 100644 +--- a/policy/modules/system/getty.te ++++ b/policy/modules/system/getty.te +@@ -34,6 +34,7 @@ files_tmp_file(getty_tmp_t) + # Use capabilities. + allow getty_t self:capability { chown dac_override fowner fsetid setgid sys_admin sys_resource sys_tty_config }; + dontaudit getty_t self:capability sys_tty_config; ++allow getty_t self:capability2 checkpoint_restore; + allow getty_t self:process { getpgid getsession setpgid signal_perms }; + allow getty_t self:fifo_file rw_fifo_file_perms; + +-- +2.44.0 + diff --git a/SPECS/selinux-policy/selinux-policy.spec b/SPECS/selinux-policy/selinux-policy.spec index 1d37c28e20a..bb56ea9b9ff 100644 --- a/SPECS/selinux-policy/selinux-policy.spec +++ b/SPECS/selinux-policy/selinux-policy.spec @@ -9,7 +9,7 @@ Summary: SELinux policy Name: selinux-policy Version: %{refpolicy_major}.%{refpolicy_minor} -Release: 5%{?dist} +Release: 6%{?dist} License: GPLv2 Vendor: Microsoft Corporation Distribution: Mariner @@ -60,6 +60,7 @@ Patch38: 0038-systemd-Fix-run-systemd-shutdown-handling.patch Patch39: 0039-modutils-Temporary-fix-for-mkinitrd-dracut.patch Patch40: 0040-For-systemd-hostnamed-service-to-run.patch Patch41: 0041-docker-Silence-io.containerd.internal.v1.opt-opt-con.patch +Patch42: 0042-getty-grant-checkpoint_restore.patch BuildRequires: bzip2 BuildRequires: checkpolicy >= %{CHECKPOLICYVER} BuildRequires: m4 @@ -345,6 +346,9 @@ exit 0 selinuxenabled && semodule -nB exit 0 %changelog +* Tue Apr 23 2024 Chris PeBenito - 2.20221101-6 +- Add getty fix for new check in kernel 6.7 + * Tue Oct 17 2023 Chris PeBenito - 2.20221101-5 - Silence noise in containerd io.containerd.internal.v1.opt plugin.