| 1 |
commit: dadb27bdd553c2e64101dc9992a1df4f6e5975d0 |
| 2 |
Author: Dannick Pomerleau <dannickp <AT> hotmail <DOT> com> |
| 3 |
AuthorDate: Fri Oct 16 00:49:49 2020 +0000 |
| 4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Mon Nov 16 09:03:43 2020 +0000 |
| 6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=dadb27bd |
| 7 |
|
| 8 |
access_vectors: Add new capabilities to cap2 |
| 9 |
|
| 10 |
Updated location of capability definitions to point to current location within kernel source code. |
| 11 |
|
| 12 |
CAP_BPF and CAP_PERFMON mainlined in: cb8e59cc87201af93dfbb6c3dccc8fcad72a09c2, original commit: a17b53c4a4b55ec322c132b6670743612229ee9c |
| 13 |
CAP_CHECKPOINT_RESTORE mainlined in: 74858abbb1032222f922487fd1a24513bbed80f9, original commit: 124ea650d3072b005457faed69909221c2905a1f |
| 14 |
|
| 15 |
The missing capabilities were noticed on archlinux with kernel 5.8.14-arch1-1. |
| 16 |
|
| 17 |
Signed-off-by: Dannick Pomerleau <dannickp <AT> hotmail.com> |
| 18 |
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> |
| 19 |
|
| 20 |
policy/flask/access_vectors | 5 ++++- |
| 21 |
1 file changed, 4 insertions(+), 1 deletion(-) |
| 22 |
|
| 23 |
diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors |
| 24 |
index a9aceb46..d464a3de 100644 |
| 25 |
--- a/policy/flask/access_vectors |
| 26 |
+++ b/policy/flask/access_vectors |
| 27 |
@@ -132,7 +132,7 @@ common x_device |
| 28 |
# |
| 29 |
common cap |
| 30 |
{ |
| 31 |
- # The capabilities are defined in include/linux/capability.h |
| 32 |
+ # The capabilities are defined in include/uapi/linux/capability.h |
| 33 |
# Capabilities >= 32 are defined in the cap2 common. |
| 34 |
# Care should be taken to ensure that these are consistent with |
| 35 |
# those definitions. (Order matters) |
| 36 |
@@ -179,6 +179,9 @@ common cap2 |
| 37 |
wake_alarm |
| 38 |
block_suspend |
| 39 |
audit_read |
| 40 |
+ perfmon |
| 41 |
+ bpf |
| 42 |
+ checkpoint_restore |
| 43 |
} |
| 44 |
|
| 45 |
# |
Archives