Fedora Account System
Red Hat Associate
Red Hat Customer
Originally this bug was opened: Bug 2369215. Under the bug for which it was marked as a duplicate, the kernel was fixed to dial back the required capability from sysadmin to setcap. Now we need a policy change to give gpsd the setcap capability. The following audit2allow te file provides the necessary capability. Could we get selinux modified to include this? # cat my-gpsd.te module my-gpsd 1.0; require { type gpsd_t; class process setcap; } #============= gpsd_t ============== allow gpsd_t self:process setcap;
FWIW, this is unrelated to the sys_admin bug. In this case gpsd simply calls some libcap function, which calls capset(2). It looks like it tries to drop privileges here: https://gitlab.com/gpsd/gpsd/-/blob/master/gpsd/gpsd.c?ref_type=heads#L2780-2803 So it should probably be allowed.
I receive this error each time I start one of my systems. Let me know if I can provide more information or testing.
I was reading the latest comment and then realized my cat output is missing in my initial description. Here it is: module my-gpsd 1.0; require { type gpsd_t; class process setcap; } #============= gpsd_t ============== allow gpsd_t self:process setcap;
*** This bug has been marked as a duplicate of bug 2441643 ***