Skip to content

Commit

Permalink
Remove all references to the lockdown class from SELinux policy
Browse files Browse the repository at this point in the history
A comprehensive fix for all the problems caused by the lockdown SELinux
class was rejected by Linus and for the lack of a better option,
the consensus upstream was to just remove the class entirely and stop
checking anything in the lockdown hook.

This commit is a follow-up to selinux-policy commit
12f821c731b2 ("Remove the lockdown-class rules from the policy").
  • Loading branch information
zpytela authored and kurik committed Jan 21, 2025
1 parent 994dab5 commit 2284e17
Showing 1 changed file with 0 additions and 9 deletions.
9 changes: 0 additions & 9 deletions src/selinux/pcp.te
Original file line number Diff line number Diff line change
Expand Up @@ -519,15 +519,6 @@ optional_policy(`
allow pcp_pmcd_t syslogd_var_run_t:file { map };
')

optional_policy(`
require {
class lockdown { integrity };
}
# pmda.kvm
# type=AVC msg=audit(YYY.101): avc: denied { integrity } for pid=PID comm="pmdakvm" lockdown_reason="debugfs access" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=lockdown permissive=0
allow pcp_pmcd_t self:lockdown integrity;
')

optional_policy(`
require {
class rawip_socket { create getopt setopt read write };
Expand Down

0 comments on commit 2284e17

Please sign in to comment.