[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/

["Kenton Groombridge" <concord@gentoo.org>]

commit:     9e64cef53a9a17bce38b43e1a8476b4132c186ea
Author:     Matt Sheets <masheets <AT> linux <DOT> microsoft <DOT> com>
AuthorDate: Sat Apr 27 00:09:53 2024 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Tue May 14 17:40:58 2024 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=9e64cef5

Allow systemd to pass down sig mask

IgnoreSIGPIPE is a feature that requires systemd to passdown the signal
mask down to the fork process. To allow this the siginh permission must
be allowed for all process domains that can be forked by systemd.

Signed-off-by: Matt Sheets <masheets <AT> linux.microsoft.com>
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/system/init.if | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 597fd169a..24be1a7a7 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -189,6 +189,7 @@ interface(`init_domain',`
 
 		allow $1 init_t:unix_stream_socket { getattr read write ioctl };
 
+		allow init_t $1:process siginh;
 		allow init_t $1:process2 { nnp_transition nosuid_transition };
 
 		# StandardInputText uses a memfd rw shm segment.