diff options
Diffstat (limited to 'recipes-security/refpolicy/refpolicy/0050-policy-modules-system-init-make-init_t-MLS-trusted-f.patch')
| -rw-r--r-- | recipes-security/refpolicy/refpolicy/0050-policy-modules-system-init-make-init_t-MLS-trusted-f.patch | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/recipes-security/refpolicy/refpolicy/0050-policy-modules-system-init-make-init_t-MLS-trusted-f.patch b/recipes-security/refpolicy/refpolicy/0050-policy-modules-system-init-make-init_t-MLS-trusted-f.patch new file mode 100644 index 0000000..9089cb2 --- /dev/null +++ b/recipes-security/refpolicy/refpolicy/0050-policy-modules-system-init-make-init_t-MLS-trusted-f.patch @@ -0,0 +1,33 @@ +From a9ceec99a527007a91ba6685d0b86c327fbb6443 Mon Sep 17 00:00:00 2001 +From: Yi Zhao <yi.zhao@windriver.com> +Date: Tue, 28 May 2019 16:41:37 +0800 +Subject: [PATCH] policy/modules/system/init: make init_t MLS trusted for + writing to keys at all levels + +Fixes: +type=AVC msg=audit(1559024138.454:31): avc: denied { link } for +pid=190 comm="(mkdir)" scontext=system_u:system_r:init_t:s0-s15:c0.c1023 +tcontext=system_u:system_r:kernel_t:s15:c0.c1023 tclass=key permissive=1 + +Upstream-Status: Inappropriate [embedded specific] + +Signed-off-by: Yi Zhao <yi.zhao@windriver.com> +--- + policy/modules/system/init.te | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te +index be9c75155..458906ac5 100644 +--- a/policy/modules/system/init.te ++++ b/policy/modules/system/init.te +@@ -237,6 +237,7 @@ mls_file_write_all_levels(init_t) + mls_process_write_all_levels(init_t) + mls_fd_use_all_levels(init_t) + mls_process_set_level(init_t) ++mls_key_write_all_levels(init_t) + + # MLS trusted for lowering/raising the level of files + mls_file_downgrade(init_t) +-- +2.25.1 + |