Skip to content

selinux-policy: Add checkpoint restore for getty. #8879

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pebenito merged 1 commit into from
Apr 24, 2024
Merged

selinux-policy: Add checkpoint restore for getty. #8879

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions SPECS/selinux-policy/0042-getty-grant-checkpoint_restore.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
From 46192c98e771f5120b62c6ab36dc1245424e7cd4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
Date: Thu, 28 Mar 2024 20:01:49 +0100
Subject: [PATCH 41/41] getty: grant checkpoint_restore
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since Linux 6.7 checkpoint-restore functionality is guareded via the
capability CAP_CHECKPOINT_RESTORE, with a fallback to CAP_SYS_ADMIN.
Grant the new capability while keeping the old one for backwards
compatibility.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
policy/modules/system/getty.te | 1 +
1 file changed, 1 insertion(+)

diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te
index bbc83a807..a900226bf 100644
--- a/policy/modules/system/getty.te
+++ b/policy/modules/system/getty.te
@@ -34,6 +34,7 @@ files_tmp_file(getty_tmp_t)
# Use capabilities.
allow getty_t self:capability { chown dac_override fowner fsetid setgid sys_admin sys_resource sys_tty_config };
dontaudit getty_t self:capability sys_tty_config;
+allow getty_t self:capability2 checkpoint_restore;
allow getty_t self:process { getpgid getsession setpgid signal_perms };
allow getty_t self:fifo_file rw_fifo_file_perms;

--
2.44.0

6 changes: 5 additions & 1 deletion SPECS/selinux-policy/selinux-policy.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
Summary: SELinux policy
Name: selinux-policy
Version: %{refpolicy_major}.%{refpolicy_minor}
Release: 5%{?dist}
Release: 6%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Mariner
Expand Down Expand Up @@ -60,6 +60,7 @@ Patch38: 0038-systemd-Fix-run-systemd-shutdown-handling.patch
Patch39: 0039-modutils-Temporary-fix-for-mkinitrd-dracut.patch
Patch40: 0040-For-systemd-hostnamed-service-to-run.patch
Patch41: 0041-docker-Silence-io.containerd.internal.v1.opt-opt-con.patch
Patch42: 0042-getty-grant-checkpoint_restore.patch
BuildRequires: bzip2
BuildRequires: checkpolicy >= %{CHECKPOLICYVER}
BuildRequires: m4
Expand Down Expand Up @@ -345,6 +346,9 @@ exit 0
selinuxenabled && semodule -nB
exit 0
%changelog
* Tue Apr 23 2024 Chris PeBenito <chpebeni@microsoft.com> - 2.20221101-6
Comment thread
pebenito marked this conversation as resolved.
- Add getty fix for new check in kernel 6.7

* Tue Oct 17 2023 Chris PeBenito <chpebeni@microsoft.com> - 2.20221101-5
- Silence noise in containerd io.containerd.internal.v1.opt plugin.

Expand Down