加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
文件
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
backport-Allow-sudodomain-send-a-null-signal-to-sshd-processe.patch 1.60 KB
一键复制 编辑 原始数据 按行查看 历史
lujie54 提交于 2022-09-02 15:54 . backport upstream patches
From c5082c2dc80dbbd549ca9a246ef97ef6cf20a277 Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Thu, 18 Nov 2021 19:29:01 +0100
Subject: [PATCH] Allow sudodomain send a null signal to sshd processes
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/c5082c2dc80dbbd549ca9a246ef97ef6cf20a277
Conflict: NA
This denial appears when maxlogins is specified in PAM limits configuration:
type=PROCTITLE msg=audit(11/18/21 13:22:44.231:774) : proctitle=sudo -u staff echo
type=SYSCALL msg=audit(11/18/21 13:22:44.231:774) : arch=x86_64 syscall=kill success=no exit=EACCES(Permission denied) a0=0x1a2c a1=SIG0 a2=0x4 a3=0x7ffd93c089cf items=0 ppid=6747 pid=6748 auid=staff uid=root gid=staff euid=root suid=root fsuid=root egid=staff sgid=staff fsgid=staff tty=(none) ses=16 comm=sudo exe=/usr/bin/sudo subj=staff_u:staff_r:staff_sudo_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(11/18/21 13:22:44.231:774) : avc: denied { signull } for pid=6748 comm=sudo scontext=staff_u:staff_r:staff_sudo_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=process permissive=0
Resolves: rhbz#1966945
Signed-off-by: lujie54 <lujie54@huawei.com>
---
policy/modules/admin/sudo.te | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/policy/modules/admin/sudo.te b/policy/modules/admin/sudo.te
index b281028..333b465 100644
--- a/policy/modules/admin/sudo.te
+++ b/policy/modules/admin/sudo.te
@@ -129,6 +129,10 @@ optional_policy(`
')
optional_policy(`
+ ssh_signull(sudodomain)
+')
+
+optional_policy(`
systemd_write_inherited_logind_sessions_pipes(sudodomain)
')
--
1.8.3.1
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化