0f539d6a39
Signed-off-by: Bihong Yu <yubihong@huawei.com> (cherry picked from commit 55aea2c2b0ccce83f2e58862c6722af4402cd469)
28 lines
938 B
Diff
28 lines
938 B
Diff
From 2724af94241663c9877e270c645dfcea124dc92c Mon Sep 17 00:00:00 2001
|
|
From: jiang-dawei15 <jiangdawei15@huawei.com>
|
|
Date: Tue, 29 Mar 2022 20:32:43 +0800
|
|
Subject: [PATCH] selinux: enable libcare-ctl to mprotect qemu process
|
|
|
|
Signed-off-by: Bihong Yu <yubihong@huawei.com>
|
|
---
|
|
dist/selinux/libcare.te | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/dist/selinux/libcare.te b/dist/selinux/libcare.te
|
|
index c240875..670c026 100644
|
|
--- a/dist/selinux/libcare.te
|
|
+++ b/dist/selinux/libcare.te
|
|
@@ -52,6 +52,9 @@ allow libcare_t libcare_file_t: lnk_file read_lnk_file_perms;
|
|
# to read patient's /proc entries and be able to attach to it
|
|
allow libcare_t self: capability { dac_override dac_read_search sys_ptrace };
|
|
|
|
+# need by remote mprotect
|
|
+allow svirt_t self : process execmem;
|
|
+
|
|
allow libcare_t svirt_t : process ptrace;
|
|
allow libcare_t svirt_t : dir list_dir_perms;
|
|
allow libcare_t svirt_t : file rw_file_perms;
|
|
--
|
|
2.27.0
|
|
|