[refpolicy] [PATCH 2/2] system/modutils: Allow kmod to use the sys_admin cap

[guido@trentalancia.net (Guido Trentalancia)]

Hello.

On Sun, 27/11/2016 at 22.22 +0100, Luis Ressel wrote:
> On Sun, 27 Nov 2016 21:33:05 +0100
> Guido Trentalancia via refpolicy <refpolicy@oss.tresys.com> wrote:
> 
> > 
> > Hello.
> > 
> > I have the same graphic card and I am not experiencing this problem
> > with kernel 4.8.8...
> > 
> > Strange, are you using vanilla kernels ?
> > 
> 
> Not exactly. I'm using Gentoo's hardened-sources kernel, which
> incorporates the GRSecurity/PaX patchset and some minor distro-
> specific
> patches. The exact kernel version I'm using is 4.8.10; on the
> userland
> side, I'm using kmod 22.
> 
> The problem arises on both of my development systems; they're using
> the
> i915 and the radeon driver, respectively. So it's indeed interesting
> that this problem doesn't manifest itself on your system. Possible
> explanations in order of descending probability:
> (1) Are you using another kmod version?

No, I am using the same 22 version.

> (2) GRSecurity (I think grsec sometimes requires specific
> capabilities
> ????in situations where vanilla doesn't.)

If it is specific to Gentoo, you should enclose the new permissions
within an ifdef block.

Also, do you have an official bug report in Gentoo ?

> (3) A difference between 4.8.8 and 4.8.10.

There is no evidence of such a change in ChangeLog-4.8.9 and ChangeLog-
4.8.10.

>From the error message that you quoted, it sounds like a call to
fs/libfs.c:simple_pin_fs() fails in drivers/gpu/drm/drm_drv.c.

However, without further evidence, I would not recommend granting the
sys_admin permission.

Regards,

Guido