From 0f539d6a399009b1b72de8bc11443d73d8ee39c3 Mon Sep 17 00:00:00 2001 From: yezengruan Date: Tue, 29 Mar 2022 21:01:58 +0800 Subject: [PATCH] selinux: enable libcare-ctl to mprotect qemu process Signed-off-by: Bihong Yu (cherry picked from commit 55aea2c2b0ccce83f2e58862c6722af4402cd469) --- ...libcare-ctl-to-mprotect-qemu-process.patch | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 selinux-enable-libcare-ctl-to-mprotect-qemu-process.patch diff --git a/selinux-enable-libcare-ctl-to-mprotect-qemu-process.patch b/selinux-enable-libcare-ctl-to-mprotect-qemu-process.patch new file mode 100644 index 0000000..02311c1 --- /dev/null +++ b/selinux-enable-libcare-ctl-to-mprotect-qemu-process.patch @@ -0,0 +1,27 @@ +From 2724af94241663c9877e270c645dfcea124dc92c Mon Sep 17 00:00:00 2001 +From: jiang-dawei15 +Date: Tue, 29 Mar 2022 20:32:43 +0800 +Subject: [PATCH] selinux: enable libcare-ctl to mprotect qemu process + +Signed-off-by: Bihong Yu +--- + dist/selinux/libcare.te | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/dist/selinux/libcare.te b/dist/selinux/libcare.te +index c240875..670c026 100644 +--- a/dist/selinux/libcare.te ++++ b/dist/selinux/libcare.te +@@ -52,6 +52,9 @@ allow libcare_t libcare_file_t: lnk_file read_lnk_file_perms; + # to read patient's /proc entries and be able to attach to it + allow libcare_t self: capability { dac_override dac_read_search sys_ptrace }; + ++# need by remote mprotect ++allow svirt_t self : process execmem; ++ + allow libcare_t svirt_t : process ptrace; + allow libcare_t svirt_t : dir list_dir_perms; + allow libcare_t svirt_t : file rw_file_perms; +-- +2.27.0 +