commit: b84ca9b9648ba7f073ad7513c4b610b7f0dfbdfc
Author: Antoine Tenart <antoine.tenart <AT> bootlin <DOT> com>
AuthorDate: Mon Sep 7 15:08:12 2020 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Oct 11 21:14:40 2020 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b84ca9b9
corecommands: add entry for Busybox shell
Fixes:
vc: denied { execute } for pid=87 comm="login" name="sh" dev="vda"
ino=408 scontext=system_u:system_r:local_login_t
tcontext=system_u:object_r:bin_t tclass=file permissive=1
Signed-off-by: Antoine Tenart <antoine.tenart <AT> bootlin.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/kernel/corecommands.fc | 1 +
1 file changed, 1 insertion(+)
diff --git a/policy/modules/kernel/corecommands.fc
b/policy/modules/kernel/corecommands.fc
index 5ced3c67..07a09873 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -157,6 +157,7 @@ ifdef(`distro_gentoo',`
/usr/bin/sesh --
gen_context(system_u:object_r:shell_exec_t,s0)
/usr/bin/scponly --
gen_context(system_u:object_r:shell_exec_t,s0)
/usr/bin/scponlyc --
gen_context(system_u:object_r:shell_exec_t,s0)
+/usr/bin/sh --
gen_context(system_u:object_r:shell_exec_t,s0)
/usr/bin/smrsh --
gen_context(system_u:object_r:shell_exec_t,s0)
/usr/bin/tcsh --
gen_context(system_u:object_r:shell_exec_t,s0)
/usr/bin/yash --
gen_context(system_u:object_r:shell_exec_t,s0)
