commit: 9af310973e98ba11a5d0efde091cd68753a7b734 Author: Lukas Vrabec <lvrabec <AT> redhat <DOT> com> AuthorDate: Thu Jul 19 22:17:27 2018 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Sun Sep 9 03:07:46 2018 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=9af31097
Improve domain_transition_pattern to allow mmap entrypoint bin file. In domain_transition_pattern there is rule: allow $1 $2:file { getattr open read execute }; map permission is missing here, which is generating lot of AVC. Replacing permissions with mmap_exec_file_perms set. policy/support/misc_patterns.spt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/support/misc_patterns.spt b/policy/support/misc_patterns.spt index 26a86dda..2cfa0313 100644 --- a/policy/support/misc_patterns.spt +++ b/policy/support/misc_patterns.spt @@ -7,7 +7,7 @@ # 3. target domain # define(`domain_transition_pattern',` - allow $1 $2:file { getattr open read execute }; + allow $1 $2:file { mmap_exec_file_perms }; allow $1 $3:process transition; dontaudit $1 $3:process { noatsecure siginh rlimitinh }; ')