28 lines
1.1 KiB
Diff
28 lines
1.1 KiB
Diff
From f33bc79e172068ca4cb47281b8fcfc9f47840b61 Mon Sep 17 00:00:00 2001
|
|
From: Ondrej Mosnacek <omosnace@redhat.com>
|
|
Date: Mon, 22 May 2023 14:30:26 +0200
|
|
Subject: [PATCH] Allow kernel to manage its own BPF objects
|
|
|
|
Kernel threads may end up calling __sys_bpf(), which does the usual BPF
|
|
access checks, so make sure kernel_t is allowed to at least operate on
|
|
its own BPF fds.
|
|
|
|
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2186595
|
|
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
|
---
|
|
policy/modules/kernel/kernel.te | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
|
|
index b86852812b..e0fcd2dff9 100644
|
|
--- a/policy/modules/kernel/kernel.te
|
|
+++ b/policy/modules/kernel/kernel.te
|
|
@@ -271,6 +271,7 @@ allow kernel_t self:unix_stream_socket connectto;
|
|
allow kernel_t self:fifo_file rw_fifo_file_perms;
|
|
allow kernel_t self:sock_file read_sock_file_perms;
|
|
allow kernel_t self:fd use;
|
|
+allow kernel_t self:bpf { map_create map_read map_write prog_load prog_run };
|
|
|
|
allow kernel_t debugfs_t:dir search_dir_perms;
|
|
|