From 6977619743bbc602a865f79562b59a80921d6063 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Mon, 21 Aug 2023 17:52:28 +0200 Subject: [PATCH] selinux: Drop user_namespace create allow rules Those are incompatible with current el9 kernels. I introduced them upstream with commit 62059058cf24 ("selinux: Fix user namespace creation after breaking kernel change"), in turn as a result of kernel commit ed5d44d42c95 ("selinux: Implement userns_create hook"), but on current el9 kernels (which lack the hook) they result in failures such as: Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/passt/cil:103 Failed to resolve AST /usr/sbin/semodule: Failed! Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/pasta/cil:104 Failed to resolve AST /usr/sbin/semodule: Failed! Signed-off-by: Stefano Brivio --- contrib/selinux/passt.te | 1 - contrib/selinux/pasta.te | 1 - 2 files changed, 2 deletions(-) diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index c6cea34..131fadc 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -92,7 +92,6 @@ allow syslogd_t self:cap_userns sys_ptrace; allow passt_t self:process setcap; allow passt_t self:capability { sys_tty_config setpcap net_bind_service setuid setgid}; allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace }; -allow passt_t self:user_namespace create; auth_read_passwd(passt_t) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 69be081..892edae 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -110,7 +110,6 @@ init_daemon_domain(pasta_t, pasta_exec_t) allow pasta_t self:capability { setpcap net_bind_service sys_tty_config dac_read_search net_admin sys_resource setuid setgid }; allow pasta_t self:cap_userns { setpcap sys_admin sys_ptrace net_admin net_bind_service }; -allow pasta_t self:user_namespace create; auth_read_passwd(pasta_t) -- 2.39.2