* [refpolicy] [PATCH] Improve domain_transition_pattern to allow mmap entrypoint bin file.
@ 2018-07-19 22:17 Lukas Vrabec
2018-07-19 23:54 ` Chris PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Lukas Vrabec @ 2018-07-19 22:17 UTC (permalink / raw)
To: refpolicy
In domain_transition_pattern there is rule:
allow $1 $2:file { getattr open read execute };
map permission is missing here, which is generating lot of AVC.
Replacing permissions with mmap_exec_file_perms set.
---
policy/support/misc_patterns.spt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/policy/support/misc_patterns.spt b/policy/support/misc_patterns.spt
index 26a86dda..2cfa0313 100644
--- a/policy/support/misc_patterns.spt
+++ b/policy/support/misc_patterns.spt
@@ -7,7 +7,7 @@
# 3. target domain
#
define(`domain_transition_pattern',`
- allow $1 $2:file { getattr open read execute };
+ allow $1 $2:file { mmap_exec_file_perms };
allow $1 $3:process transition;
dontaudit $1 $3:process { noatsecure siginh rlimitinh };
')
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [refpolicy] [PATCH] Improve domain_transition_pattern to allow mmap entrypoint bin file.
2018-07-19 22:17 [refpolicy] [PATCH] Improve domain_transition_pattern to allow mmap entrypoint bin file Lukas Vrabec
@ 2018-07-19 23:54 ` Chris PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Chris PeBenito @ 2018-07-19 23:54 UTC (permalink / raw)
To: refpolicy
On 07/19/2018 06:17 PM, Lukas Vrabec via refpolicy wrote:
> In domain_transition_pattern there is rule:
> allow $1 $2:file { getattr open read execute };
>
> map permission is missing here, which is generating lot of AVC.
> Replacing permissions with mmap_exec_file_perms set.
> ---
> policy/support/misc_patterns.spt | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/policy/support/misc_patterns.spt b/policy/support/misc_patterns.spt
> index 26a86dda..2cfa0313 100644
> --- a/policy/support/misc_patterns.spt
> +++ b/policy/support/misc_patterns.spt
> @@ -7,7 +7,7 @@
> # 3. target domain
> #
> define(`domain_transition_pattern',`
> - allow $1 $2:file { getattr open read execute };
> + allow $1 $2:file { mmap_exec_file_perms };
> allow $1 $3:process transition;
> dontaudit $1 $3:process { noatsecure siginh rlimitinh };
> ')
Merged.
--
Chris PeBenito
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-07-19 23:54 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-19 22:17 [refpolicy] [PATCH] Improve domain_transition_pattern to allow mmap entrypoint bin file Lukas Vrabec
2018-07-19 23:54 ` Chris PeBenito
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).