[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/contrib/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     83244b1264056d64fe3c979671a68ec3a80cd7dd
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Sun May  7 03:39:18 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun May  7 17:40:29 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=83244b12

chromium: allow cap_userns for the sandbox

https://patchwork.kernel.org/patch/8785151/

 policy/modules/contrib/chromium.te | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/policy/modules/contrib/chromium.te b/policy/modules/contrib/chromium.te
index cd1e1116..a4fba97c 100644
--- a/policy/modules/contrib/chromium.te
+++ b/policy/modules/contrib/chromium.te
@@ -89,10 +89,12 @@ xdg_cache_home_content(chromium_xdg_cache_t)
 #
 
 # execmem for load in plugins
-allow chromium_t self:process { execmem getsched setcap setrlimit setsched sigkill signal };
-allow chromium_t self:fifo_file rw_fifo_file_perms;;
+allow chromium_t self:process { execmem getsched getcap setcap setrlimit setsched sigkill signal };
+allow chromium_t self:fifo_file rw_fifo_file_perms;
 allow chromium_t self:sem create_sem_perms;
 allow chromium_t self:netlink_kobject_uevent_socket client_stream_socket_perms;
+# cap_userns sys_admin for the sandbox
+allow chromium_t self:cap_userns { sys_admin sys_chroot sys_ptrace };
 
 allow chromium_t chromium_exec_t:file execute_no_trans;
 
@@ -135,6 +137,7 @@ domtrans_pattern(chromium_t, chromium_sandbox_exec_t, chromium_sandbox_t)
 domtrans_pattern(chromium_t, chromium_naclhelper_exec_t, chromium_naclhelper_t)
 
 kernel_list_proc(chromium_t)
+kernel_read_net_sysctls(chromium_t)
 
 corecmd_exec_bin(chromium_t)
 # Look for /etc/gentoo-release through a shell invocation running find