Skip to contentSkip to conversation

refpolicy: Allow ping to get/set capabilities

PATCH Applied [email protected] 2 participants 3 messages Jan 28, 2014

lore
Share & tools
lore

[email protected]

author
#0 lore raw

cover refpolicy: Allow ping to get/set capabilities

From: Wenzong Fan <[email protected]>

When ping is installed with capabilities instead of being marked setuid, then the ping_t domain needs to be allowed to getcap/setcap.

This patch was backported from upstream.

The following changes since commit 271955d346f305b196f069d9dc46db16c43678de:

refpolicy: fix real path for swapoff (2014-01-28 15:20:19 +0800)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib wenzong/fix-ping
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/fix-ping

Wenzong Fan (1):
refpolicy: Allow ping to get/set capabilities

 .../Allow-ping-to-get-set-capabilities.patch       |   32 ++++++++++++++++++++
 .../refpolicy/refpolicy_2.20130424.inc             |    4 +++
 2 files changed, 36 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/Allow-ping-to-get-set-capabilities.patch
Signature · 1 line
1.7.9.5
author
#1 lore raw

PATCH 1/1 refpolicy: Allow ping to get/set capabilities

From: Wenzong Fan <[email protected]>

When ping is installed with capabilities instead of being marked setuid, then the ping_t domain needs to be allowed to getcap/setcap.

Signed-off-by Wenzong Fan <[email protected]>
---
 .../Allow-ping-to-get-set-capabilities.patch       |   32 ++++++++++++++++++++
 .../refpolicy/refpolicy_2.20130424.inc             |    4 +++
 2 files changed, 36 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/Allow-ping-to-get-set-capabilities.patch
recipes-security/refpolicy/refpolicy-2.20130424/Allow-ping-to-get-set-capabilities.patch new file +32 -0
new file mode 100644
index 0000000..fced84a
@@ -0,0 +1,32 @@
+From 56c43144d7dcf5fec969c9aa9cb97679ccad50cc Mon Sep 17 00:00:00 2001
+From: Sven Vermeulen <[email protected]>
+Date: Wed, 25 Sep 2013 20:27:34 +0200
+Subject: [PATCH] Allow ping to get/set capabilities
+
+When ping is installed with capabilities instead of being marked setuid,
+then the ping_t domain needs to be allowed to getcap/setcap.
+
+Reported-by: Luis Ressel <[email protected]>
+Signed-off-by: Sven Vermeulen <[email protected]>
+
+Upstream-Status: backport
+---
+ policy/modules/admin/netutils.te |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/policy/modules/admin/netutils.te b/policy/modules/admin/netutils.te
+index 557da97..cfe036a 100644
+--- a/policy/modules/admin/netutils.te
++++ b/policy/modules/admin/netutils.te
+@@ -106,6 +106,8 @@ optional_policy(`
+ #
+ 
+ allow ping_t self:capability { setuid net_raw };
++# When ping is installed with capabilities instead of setuid
++allow ping_t self:process { getcap setcap };
+ dontaudit ping_t self:capability sys_tty_config;
+ allow ping_t self:tcp_socket create_socket_perms;
+ allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt };
+-- 
+1.7.10.4
+
recipes-security/refpolicy/refpolicy_2.20130424.inc +4 -0
index cb1dec6..4b618b2 100644
@@ -52,4 +52,8 @@ SRC_URI += "file://poky-policy-fix-xconsole_device_t-as-a-dev_node.patch \
             file://poky-policy-fix-dmesg-to-use-dev-kmsg.patch \
            "
 
+# Backport from upstream
+SRC_URI += "file://Allow-ping-to-get-set-capabilities.patch \
+           "
+
 include refpolicy_common.inc
Signature · 1 line
1.7.9.5
Applied
#2 lore raw
In reply to [email protected]
Quoted 16 lines · 于 14-1-28 下午3:54, [email protected] 写道:

From: Wenzong Fan <[email protected]>

When ping is installed with capabilities instead of being marked setuid, then the ping_t domain needs to be allowed to getcap/setcap.

This patch was backported from upstream.

The following changes since commit 271955d346f305b196f069d9dc46db16c43678de:

refpolicy: fix real path for swapoff (2014-01-28 15:20:19 +0800)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib wenzong/fix-ping
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/fix-ping

Quoted 8 lines

Wenzong Fan (1):
refpolicy: Allow ping to get/set capabilities

  .../Allow-ping-to-get-set-capabilities.patch       |   32 ++++++++++++++++++++
  .../refpolicy/refpolicy_2.20130424.inc             |    4 +++
  2 files changed, 36 insertions(+)

create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/Allow-ping-to-get-set-capabilities.patch

Merged, thanks.

Signature · 1 line
- Pascal