On Fri, Feb 25, 2022 at 4:38 PM Richard Haines
<richard_c_haines@xxxxxxxxxxxxxx> wrote:
>
> If 'ioctl_skip_cloexec' set, kernel will always allow FIOCLEX and FIONCLEX
> ioctls.
>
> Signed-off-by: Richard Haines <richard_c_haines@xxxxxxxxxxxxxx>
Acked-by: James Carter <jwcart2@xxxxxxxxx>
> ---
> V2 Change: Use POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC
>
> libsepol/include/sepol/policydb/polcaps.h | 1 +
> libsepol/src/polcaps.c | 1 +
> 2 files changed, 2 insertions(+)
>
> diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
> index 40669fb5..39c99839 100644
> --- a/libsepol/include/sepol/policydb/polcaps.h
> +++ b/libsepol/include/sepol/policydb/polcaps.h
> @@ -14,6 +14,7 @@ enum {
> POLICYDB_CAPABILITY_CGROUPSECLABEL,
> POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION,
> POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS,
> + POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC,
> __POLICYDB_CAPABILITY_MAX
> };
> #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
> diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
> index 6a74ec7d..a5e515f2 100644
> --- a/libsepol/src/polcaps.c
> +++ b/libsepol/src/polcaps.c
> @@ -13,6 +13,7 @@ static const char * const polcap_names[] = {
> "cgroup_seclabel", /* POLICYDB_CAPABILITY_SECLABEL */
> "nnp_nosuid_transition", /* POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION */
> "genfs_seclabel_symlinks", /* POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS */
> + "ioctl_skip_cloexec", /* POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC */
> NULL
> };
>
> --
> 2.35.1
>
