On Mon, Feb 28, 2022 at 4:43 PM James Carter <jwcart2@xxxxxxxxx> wrote:
>
> On Fri, Feb 25, 2022 at 4:38 PM Richard Haines
> <richard_c_haines@xxxxxxxxxxxxxx> wrote:
> >
> > If 'ioctl_skip_cloexec' set, kernel will always allow FIOCLEX and FIONCLEX
> > ioctls.
> >
> > Signed-off-by: Richard Haines <richard_c_haines@xxxxxxxxxxxxxx>
>
> Acked-by: James Carter <jwcart2@xxxxxxxxx>
>
Merged.
Thanks,
Jim
> > ---
> > V2 Change: Use POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC
> >
> > libsepol/include/sepol/policydb/polcaps.h | 1 +
> > libsepol/src/polcaps.c | 1 +
> > 2 files changed, 2 insertions(+)
> >
> > diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
> > index 40669fb5..39c99839 100644
> > --- a/libsepol/include/sepol/policydb/polcaps.h
> > +++ b/libsepol/include/sepol/policydb/polcaps.h
> > @@ -14,6 +14,7 @@ enum {
> > POLICYDB_CAPABILITY_CGROUPSECLABEL,
> > POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION,
> > POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS,
> > + POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC,
> > __POLICYDB_CAPABILITY_MAX
> > };
> > #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
> > diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
> > index 6a74ec7d..a5e515f2 100644
> > --- a/libsepol/src/polcaps.c
> > +++ b/libsepol/src/polcaps.c
> > @@ -13,6 +13,7 @@ static const char * const polcap_names[] = {
> > "cgroup_seclabel", /* POLICYDB_CAPABILITY_SECLABEL */
> > "nnp_nosuid_transition", /* POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION */
> > "genfs_seclabel_symlinks", /* POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS */
> > + "ioctl_skip_cloexec", /* POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC */
> > NULL
> > };
> >
> > --
> > 2.35.1
> >
