commit: 9af310973e98ba11a5d0efde091cd68753a7b734
Author: Lukas Vrabec <lvrabec <AT> redhat <DOT> com>
AuthorDate: Thu Jul 19 22:17:27 2018 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Sep 9 03:07:46 2018 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=9af31097
Improve domain_transition_pattern to allow mmap entrypoint bin file.
In domain_transition_pattern there is rule:
allow $1 $2:file { getattr open read execute };
map permission is missing here, which is generating lot of AVC.
Replacing permissions with mmap_exec_file_perms set.
policy/support/misc_patterns.spt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/policy/support/misc_patterns.spt b/policy/support/misc_patterns.spt
index 26a86dda..2cfa0313 100644
--- a/policy/support/misc_patterns.spt
+++ b/policy/support/misc_patterns.spt
@@ -7,7 +7,7 @@
# 3. target domain
#
define(`domain_transition_pattern',`
- allow $1 $2:file { getattr open read execute };
+ allow $1 $2:file { mmap_exec_file_perms };
allow $1 $3:process transition;
dontaudit $1 $3:process { noatsecure siginh rlimitinh };
')
