[refpolicy] [PATCH 2/2] system/modutils: Allow kmod to use the sys_admin cap

[guido@trentalancia.net (Guido Trentalancia)]

Hello. 

If you revert the getty commit that I mentioned earlier on, you get back ifdef distro_redhat, so eventually you only need to add the new ifdef grsecurity. 

Finally, as already explained, on a plain system kmod does not need sys_admin either. 

It's something related only to your specific system that requires the sys_admin capability permission.

Only you can find out whether this is due to grsecurity or other patches...

I hope it helps... 

Regards, 

Guido 

On the 29th novembre 2016 00:03:59 CET, Luis Ressel <aranea@aixah.de> wrote:
>On Mon, 28 Nov 2016 23:24:10 +0100
>Guido Trentalancia via refpolicy <refpolicy@oss.tresys.com> wrote:
>
>> It's very easy !...
>> 
>> You can create a patch that reverts
>> commit?7216d000d94342dc347a976a7a6a65f40a2f41cb and then adds an
>> "ifdef grsecurity" for such sys_admin permission (for getty and/or
>> kmod).
>
>Thanks, I'm perfectly aware of *how* to do this, but I'd like to
>achieve
>a broader consensus first (specifically, I'd really like to hear
>Dominick's and Chris' opinions).
>
>Plus, we should first find out if there actually are any other
>permissions in the refpolicy which pertain to grsec requirements. As
>I've mentioned, cap_sys_admin may actually be required for agetty even
>on non-grsec systems (I think Dominick said so, and it used to be
>granted by distro_redhat, too). And we haven't established yet whether
>kmod needing cap_sys_admin is grsec-related anyway. Therefore, we might
>perhaps be left with no grsec-specific permissions at all. :)
>
>> Enclosing them in double ifdef should not be necessary. In my
>opinion,
>> the former proposal is enough (ifdef grsecurity).
>
>Of course double ifdef's wouldn't make much sense. I was merely
>suggesting that we could use distro_gentoo for this instead of adding a
>new ifdef variable.
>
>Regards,
>Luis