53 lines
2.0 KiB
Diff
53 lines
2.0 KiB
Diff
From 7087adfbab35354f9def7edee87385b82416c722 Mon Sep 17 00:00:00 2001
|
|
From: Stefano Brivio <sbrivio@redhat.com>
|
|
Date: Mon, 8 Dec 2025 22:32:50 -0500
|
|
Subject: [PATCH] selinux: Drop user_namespace create allow rules
|
|
|
|
Those are incompatible with current el9 kernels. I introduced them
|
|
upstream with commit 62059058cf24 ("selinux: Fix user namespace
|
|
creation after breaking kernel change"), in turn as a result of
|
|
kernel commit ed5d44d42c95 ("selinux: Implement userns_create hook"),
|
|
but on current el9 kernels (which lack the hook) they result in
|
|
failures such as:
|
|
|
|
Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/passt/cil:103
|
|
Failed to resolve AST
|
|
/usr/sbin/semodule: Failed!
|
|
Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/pasta/cil:104
|
|
Failed to resolve AST
|
|
/usr/sbin/semodule: Failed!
|
|
|
|
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
|
|
---
|
|
contrib/selinux/passt.te | 1 -
|
|
contrib/selinux/pasta.te | 1 -
|
|
2 files changed, 2 deletions(-)
|
|
|
|
diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
|
|
index 6995df8..76d23e8 100644
|
|
--- a/contrib/selinux/passt.te
|
|
+++ b/contrib/selinux/passt.te
|
|
@@ -105,7 +105,6 @@ allow syslogd_t self:cap_userns sys_ptrace;
|
|
allow passt_t self:process setcap;
|
|
allow passt_t self:capability { sys_tty_config setpcap net_bind_service setuid setgid};
|
|
allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace };
|
|
-allow passt_t self:user_namespace create;
|
|
|
|
auth_read_passwd(passt_t)
|
|
|
|
diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
|
|
index 95fe42a..7e1e821 100644
|
|
--- a/contrib/selinux/pasta.te
|
|
+++ b/contrib/selinux/pasta.te
|
|
@@ -126,7 +126,6 @@ allow pasta_t self:cap_userns { setpcap sys_admin sys_ptrace net_admin net_bind_
|
|
# pasta only calls setuid and setgid with the current UID and GID, so this
|
|
# denial is harmless. See https://bugzilla.redhat.com/show_bug.cgi?id=2330512#c10
|
|
dontaudit pasta_t self:cap_userns { setgid setuid };
|
|
-allow pasta_t self:user_namespace create;
|
|
|
|
auth_read_passwd(pasta_t)
|
|
|
|
--
|
|
2.47.1
|
|
|