Skip to content

Commit

Permalink
Add map_read map_write to kernel_prog_run_bpf
Browse files Browse the repository at this point in the history
Add permissions map_read map_write to interface kernel_prog_run_bpf

Addresses the following denial:

type=PROCTITLE msg=audit(09/08/2023 08:54:15.988:1779) : proctitle=bpftool prog
type=SYSCALL msg=audit(09/08/2023 08:54:15.988:1779) : arch=x86_64 syscall=bpf success=no exit=EACCES(Permission denied) a0=BPF_MAP_GET_FD_BY_ID a1=0x7ffcd6d40250 a2=0xc a3=0x0 items=0 ppid=139832 pid=139833 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts2 ses=18 comm=bpftool exe=/usr/sbin/bpftool subj=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(09/08/2023 08:54:15.988:1779) : avc: denied { map_read map_write } for pid=139833 comm=bpftool scontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=bpf permissive=0

Resolves: RHEL-2653
  • Loading branch information
5umm3r15 committed Oct 6, 2023
1 parent 74fd8bb commit 255eea4
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion policy/modules/kernel/kernel.if
Original file line number Diff line number Diff line change
Expand Up @@ -4507,7 +4507,7 @@ interface(`kernel_prog_run_bpf',`
type init_t;
')

allow $1 kernel_t:bpf prog_run;
allow $1 kernel_t:bpf { map_read map_write prog_run };
')

########################################
Expand Down

0 comments on commit 255eea4

Please sign in to comment.