[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/flask/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     dadb27bdd553c2e64101dc9992a1df4f6e5975d0
Author:     Dannick Pomerleau <dannickp <AT> hotmail <DOT> com>
AuthorDate: Fri Oct 16 00:49:49 2020 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Nov 16 09:03:43 2020 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=dadb27bd

access_vectors: Add new capabilities to cap2

Updated location of capability definitions to point to current location within kernel source code.

CAP_BPF and CAP_PERFMON mainlined in: cb8e59cc87201af93dfbb6c3dccc8fcad72a09c2, original commit: a17b53c4a4b55ec322c132b6670743612229ee9c
CAP_CHECKPOINT_RESTORE mainlined in: 74858abbb1032222f922487fd1a24513bbed80f9, original commit: 124ea650d3072b005457faed69909221c2905a1f

The missing capabilities were noticed on archlinux with kernel 5.8.14-arch1-1.

Signed-off-by: Dannick Pomerleau <dannickp <AT> hotmail.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/flask/access_vectors | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
index a9aceb46..d464a3de 100644
--- a/policy/flask/access_vectors
+++ b/policy/flask/access_vectors
@@ -132,7 +132,7 @@ common x_device
 #
 common cap
 {
-	# The capabilities are defined in include/linux/capability.h
+	# The capabilities are defined in include/uapi/linux/capability.h
 	# Capabilities >= 32 are defined in the cap2 common.
 	# Care should be taken to ensure that these are consistent with
 	# those definitions. (Order matters)
@@ -179,6 +179,9 @@ common cap2
 	wake_alarm
 	block_suspend
 	audit_read
+	perfmon
+	bpf
+	checkpoint_restore
 }
 
 #