From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 3181E138CC5 for ; Wed, 25 Mar 2015 15:55:46 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 8984CE07EA; Wed, 25 Mar 2015 15:55:45 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 2B296E07EA for ; Wed, 25 Mar 2015 15:55:45 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 5181A340897 for ; Wed, 25 Mar 2015 15:55:44 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id DFFE11483D for ; Wed, 25 Mar 2015 15:55:38 +0000 (UTC) From: "Jason Zaman" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" Message-ID: <1427298725.df65cfff17b72258446578aafe99edac7ea237bd.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/rpc.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: df65cfff17b72258446578aafe99edac7ea237bd X-VCS-Branch: master Date: Wed, 25 Mar 2015 15:55:38 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 10408065-38d3-4a84-901e-45e9fe23079a X-Archives-Hash: f023730baf440d297142ff7c1882d8ef Message-ID: <20150325155538.5BI2NMwpVYJOTlsj05z_xeLXqP4adOZH7qZCOIjTmVY@z> commit: df65cfff17b72258446578aafe99edac7ea237bd Author: Jason Zaman perfinion com> AuthorDate: Wed Mar 25 02:24:44 2015 +0000 Commit: Jason Zaman gentoo org> CommitDate: Wed Mar 25 15:52:05 2015 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=df65cfff rpc: allow setgid capability rpc.gssd needs to be able to setgid, otherwise using a kerberized nfs mount fails with permission denied. errors: rpc.gssd[22887]: WARNING: unable to drop supplimentary groups! rpc.gssd[22887]: WARNING: failed to change identity: Operation not permitted denials: type=AVC msg=audit(1427206637.030:9956): avc: denied { setgid } for pid=22887 comm="rpc.gssd" capability=6 scontext=system_u:system_r:gssd_t tcontext=system_u:system_r:gssd_t tclass=capability permissive=0 type=SYSCALL msg=audit(1427206637.030:9956): arch=c000003e syscall=116 success=no exit=-1 a0=0 a1=0 a2=5111a30e20 a3=31fc5672090 items=0 ppid=22763 pid=22887 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="rpc.gssd" exe="/usr/sbin/rpc.gssd" subj=system_u:system_r:gssd_t key=(null) policy/modules/contrib/rpc.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/modules/contrib/rpc.te b/policy/modules/contrib/rpc.te index 66f77ab..cf4d1fc 100644 --- a/policy/modules/contrib/rpc.te +++ b/policy/modules/contrib/rpc.te @@ -282,7 +282,7 @@ optional_policy(` # GSSD local policy # -allow gssd_t self:capability { dac_override dac_read_search setuid sys_nice }; +allow gssd_t self:capability { dac_override dac_read_search setuid setgid sys_nice }; allow gssd_t self:process { getsched setsched }; allow gssd_t self:fifo_file rw_fifo_file_perms;