diff options
| author | Stefano Brivio <sbrivio@redhat.com> | 2023-08-21 17:52:28 +0200 |
|---|---|---|
| committer | David Gibson <david@gibson.dropbear.id.au> | 2025-04-02 14:32:10 +1100 |
| commit | e5575743d9a51941ff652f8edf98aec1642b521b (patch) | |
| tree | afe40f74173ef323d1671b920f94a1ea41de4d6c | |
| parent | a1e48a02ff3550eb7875a7df6726086e9b3a1213 (diff) | |
| download | passt-e5575743d9a51941ff652f8edf98aec1642b521b.tar passt-e5575743d9a51941ff652f8edf98aec1642b521b.tar.gz passt-e5575743d9a51941ff652f8edf98aec1642b521b.tar.bz2 passt-e5575743d9a51941ff652f8edf98aec1642b521b.tar.lz passt-e5575743d9a51941ff652f8edf98aec1642b521b.tar.xz passt-e5575743d9a51941ff652f8edf98aec1642b521b.tar.zst passt-e5575743d9a51941ff652f8edf98aec1642b521b.zip | |
selinux: Drop user_namespace create allow rules
Those are incompatible with current el9 kernels. I introduced them
upstream with commit 62059058cf24 ("selinux: Fix user namespace
creation after breaking kernel change"), in turn as a result of
kernel commit ed5d44d42c95 ("selinux: Implement userns_create hook"),
but on current el9 kernels (which lack the hook) they result in
failures such as:
Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/passt/cil:103
Failed to resolve AST
/usr/sbin/semodule: Failed!
Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/pasta/cil:104
Failed to resolve AST
/usr/sbin/semodule: Failed!
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
| -rw-r--r-- | contrib/selinux/passt.te | 1 | ||||
| -rw-r--r-- | contrib/selinux/pasta.te | 1 |
2 files changed, 0 insertions, 2 deletions
diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index f595079..cd1e5ee 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -102,7 +102,6 @@ allow syslogd_t self:cap_userns sys_ptrace; allow passt_t self:process setcap; allow passt_t self:capability { sys_tty_config setpcap net_bind_service setuid setgid}; allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace }; -allow passt_t self:user_namespace create; auth_read_passwd(passt_t) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 89c8043..656838d 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -113,7 +113,6 @@ init_daemon_domain(pasta_t, pasta_exec_t) allow pasta_t self:capability { setpcap net_bind_service sys_tty_config dac_read_search net_admin sys_resource setuid setgid }; allow pasta_t self:cap_userns { setpcap sys_admin sys_ptrace net_admin net_bind_service }; -allow pasta_t self:user_namespace create; auth_read_passwd(pasta_t) |