quine-global-labs/mirror-ublue-os-packages
1
0
Fork 0
mirror of https://github.com/ublue-os/packages.git synced 2026-11-03 21:49:48 -09:00
Code Issues Projects Releases Packages Wiki Activity

fix(selinux): add composefs execmem workaround package (#1255)

Browse source
This commit is contained in:
Benjamin Sherman 2026-06-01 17:24:07 -05:00 committed by GitHub
parent 291424432d
commit ea00421b48
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 64 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
packages/ublue-os-selinux-workarounds/src/selinux/ublue_os_composefs_execmem.te Normal file
View file

@ -0,0 +1,13 @@
module ublue_os_composefs_execmem 0.1;
require {
type kernel_t;
class process execmem;
}
# Temporary mitigation for Linux 7.0 composefs/overlay backing-file mmap checks:
# user-space mappings from /usr can be evaluated with backing-file credentials
# that appear as kernel_t, causing legitimate 32-bit userspace mappings to fail.
#
# Tracking: https://github.com/ublue-os/akmods/issues/537
allow kernel_t self:process execmem;

51
packages/ublue-os-selinux-workarounds/ublue-os-selinux-workarounds.spec Normal file
View file

@ -0,0 +1,51 @@
Name: ublue-os-selinux-workarounds
Vendor: ublue-os
Version: 0.1
Release: 1%{?dist}
Summary: SELinux policy workarounds for ublue-os images
License: Apache-2.0
URL: https://github.com/ublue-os/packages
VCS: {{{ git_dir_vcs }}}
Source: {{{ git_dir_pack }}}
BuildArch: noarch
BuildRequires: checkpolicy
BuildRequires: policycoreutils
BuildRequires: selinux-policy
BuildRequires: selinux-policy-devel
%{?selinux_requires}
%global policy_module ublue_os_composefs_execmem
%description
Installs targeted SELinux policy workarounds for ublue-os images.
This currently contains a narrow temporary mitigation for Linux 7.0
composefs/overlay backing-file mmap checks causing legitimate userspace
execmem mappings to be evaluated as kernel_t.
%prep
{{{ git_dir_setup_macro }}}
%build
checkmodule -M -m -o %{policy_module}.mod src/selinux/%{policy_module}.te
semodule_package -o %{policy_module}.pp -m %{policy_module}.mod
%install
install -Dm0644 %{policy_module}.pp %{buildroot}%{_datadir}/selinux/packages/%{policy_module}.pp
%check
%post
%selinux_modules_install %{_datadir}/selinux/packages/%{policy_module}.pp
%postun
if [ $1 -eq 0 ]; then
%selinux_modules_uninstall %{_datadir}/selinux/packages/%{policy_module}.pp
fi
%files
%{_datadir}/selinux/packages/%{policy_module}.pp
%changelog
%autochangelog