aboutsummaryrefslogtreecommitdiffstats
path: root/recipes-security/refpolicy/refpolicy/0038-policy-modules-system-logging-grant-getpcap-capabili.patch
blob: 3f8d1bd0bc762bae16f5573f6d77efc9b62ed6cb (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
From c54c53f8765c4401aa4c1b4a6204c8b538c008ad Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Tue, 28 May 2024 11:21:48 +0800
Subject: [PATCH] policy/modules/system/logging: grant getpcap capability to
 syslogd_t

The rsyslog is configured with --enable-libpcap which requires getpcap
capability.

Fixes:
avc: denied { setpcap } for pid=317 comm="rsyslogd" capability=8
scontext=system_u:system_r:syslogd_t:s15:c0.c1023
tcontext=system_u:system_r:syslogd_t:s15:c0.c1023 tclass=capability
permissive=1

Upstream-Status: Inappropriate [embedded specific]

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 policy/modules/system/logging.te | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index df6095805..086498936 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -402,6 +402,8 @@ optional_policy(`
 # sys_admin for the integrated klog of syslog-ng and metalog
 # sys_nice for rsyslog
 allow syslogd_t self:capability { chown dac_override fsetid setgid setuid sys_admin sys_nice sys_resource sys_tty_config };
+# Rsyslog configures with --enable-libcap-ng
+allow syslogd_t self:capability setpcap;
 dontaudit syslogd_t self:capability { sys_ptrace };
 dontaudit syslogd_t self:cap_userns { kill sys_ptrace };
 # setpgid for metalog
-- 
2.25.1