[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/support/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     9af310973e98ba11a5d0efde091cd68753a7b734
Author:     Lukas Vrabec <lvrabec <AT> redhat <DOT> com>
AuthorDate: Thu Jul 19 22:17:27 2018 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Sep  9 03:07:46 2018 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=9af31097

Improve domain_transition_pattern to allow mmap entrypoint bin file.

In domain_transition_pattern there is rule:
allow $1 $2:file { getattr open read execute };

map permission is missing here, which is generating lot of AVC.
Replacing permissions with mmap_exec_file_perms set.

 policy/support/misc_patterns.spt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/policy/support/misc_patterns.spt b/policy/support/misc_patterns.spt
index 26a86dda..2cfa0313 100644
--- a/policy/support/misc_patterns.spt
+++ b/policy/support/misc_patterns.spt
@@ -7,7 +7,7 @@
 # 3. target domain
 #
 define(`domain_transition_pattern',`
-	allow $1 $2:file { getattr open read execute };
+	allow $1 $2:file { mmap_exec_file_perms };
 	allow $1 $3:process transition;
 	dontaudit $1 $3:process { noatsecure siginh rlimitinh };
 ')