Projects
openEuler:22.03:LTS:LoongArch
selinux-policy
_service:tar_scm_kernel_repo:backport-Add-numad...
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm_kernel_repo:backport-Add-numad-the-ipc_owner-capability.patch of Package selinux-policy
From 8cc57cc64467d6e60eac92d6ffc9f9d550e948a2 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela <zpytela@redhat.com> Date: Wed, 21 Sep 2022 17:20:28 +0200 Subject: [PATCH] Add numad the ipc_owner capability This permission is required when the cpu allocation in a vm definition contains <vcpu placement="auto" /> which means cpuset option will be configured by querying numad. Addresses the following AVC denial: type=AVC msg=audit(1637903670.950:2626): avc: denied { ipc_owner } for pid=72952 comm="numad" capability=15 scontext=system_u:system_r:numad_t:s0-s0:c0.c1023 tcontext=system_u:system_r:numad_t:s0-s0:c0.c1023 tclass=capability permissive=0 Resolves: rhbz#2026968 Signed-off-by: lujie42 <lujie54@huawei.com> --- policy/modules/contrib/numad.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/modules/contrib/numad.te b/policy/modules/contrib/numad.te index cf8f99b02..97f923b25 100644 --- a/policy/modules/contrib/numad.te +++ b/policy/modules/contrib/numad.te @@ -23,7 +23,7 @@ files_pid_file(numad_var_run_t) # numad local policy # -allow numad_t self:capability { kill sys_nice sys_ptrace } ; +allow numad_t self:capability { ipc_owner kill sys_nice sys_ptrace } ; allow numad_t self:fifo_file rw_fifo_file_perms; allow numad_t self:msgq create_msgq_perms; allow numad_t self:msg { send receive }; -- 2.27.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.