aboutgitcodebugslistschat
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2023-11-07 12:28:27 +0100
committerStefano Brivio <sbrivio@redhat.com>2023-11-07 12:28:27 +0100
commit74e6f48038e64bbdfa5fa265db330f95ce68c182 (patch)
treece541306f7b570e831786aa02681d57e45c0893b
parent50bc25a23cfb2c9f3708cfdb3e2787ddf3d5ab34 (diff)
downloadpasst-74e6f48038e64bbdfa5fa265db330f95ce68c182.tar
passt-74e6f48038e64bbdfa5fa265db330f95ce68c182.tar.gz
passt-74e6f48038e64bbdfa5fa265db330f95ce68c182.tar.bz2
passt-74e6f48038e64bbdfa5fa265db330f95ce68c182.tar.lz
passt-74e6f48038e64bbdfa5fa265db330f95ce68c182.tar.xz
passt-74e6f48038e64bbdfa5fa265db330f95ce68c182.tar.zst
passt-74e6f48038e64bbdfa5fa265db330f95ce68c182.zip
selinux: Allow passt to talk over unconfined_t UNIX domain socket for --fd2023_11_07.74e6f48
If passt is started with --fd to talk over a pre-opened UNIX domain socket, we don't really know what label might be associated to it, but at least for an unconfined_t socket, this bit of policy wouldn't belong to anywhere else: enable that here. This is rather loose, of course, but on the other hand passt will sandbox itself into an empty filesystem, so we're not really adding much to the attack surface except for what --fd is supposed to do. Reported-by: Matej Hrica <mhrica@redhat.com> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2247221 Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
-rw-r--r--contrib/selinux/passt.te1
1 files changed, 1 insertions, 0 deletions
diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
index ea768d9..401c9c3 100644
--- a/contrib/selinux/passt.te
+++ b/contrib/selinux/passt.te
@@ -124,3 +124,4 @@ allow passt_t self:icmp_socket { bind create setopt read write };
allow passt_t user_tmp_t:dir { add_name write };
allow passt_t user_tmp_t:file { create open };
allow passt_t user_tmp_t:sock_file { create read write unlink };
+allow passt_t unconfined_t:unix_stream_socket { read write };