Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

libsepol: add patch to fix checking "all" permissions #3907

Merged
merged 1 commit into from
Apr 23, 2024

Conversation

arnaldo2792
Copy link
Contributor

Description of changes:

This patch fixes a bug introduced in the latest release, which prevents classes with inherited permissions from passing verification checks.

Testing done:

Without this patch, in a custom OOTB, I see this error:

Operator "all" used for sem which has no permissions associated with it at /var/lib/selinux/fortified/tmp/modules/100/class/cil:215
Error verifying class permissions for map class ipcs, permission use at /var/lib/selinux/fortified/tmp/modules/100/ipcs/cil:2
Failed to verify cil database
Failed to verify cil database
Post process failed

With this patch, the error is gone.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

This patch fixes a bug introduced in the latest release, which prevents
classes with inherited permissions from passing verification checks.

Signed-off-by: Arnaldo Garcia Rincon <[email protected]>
@arnaldo2792 arnaldo2792 merged commit 9bcac49 into bottlerocket-os:develop Apr 23, 2024
33 checks passed
@ginglis13 ginglis13 mentioned this pull request May 7, 2024
14 tasks
@arnaldo2792 arnaldo2792 deleted the patch-libselinux branch September 5, 2024 17:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants