Created attachment 357551 [details] Patch to drop capabilities Description of problem: As part of the lowering capabilities project, we should drop all unnecessary capabilities in all daemons.
Any progress on this? Thanks.
Building with that patch applied, I get: type=AVC msg=audit(1254369329.201:17): avc: denied { setpcap } for pid=1784 comm="kerneloops" capability=8 scontext=system_u:system_r:kerneloops_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kerneloops_t:s0-s0:c0.c1023 tclass=capability type=SYSCALL msg=audit(1254369329.201:17): arch=c000003e syscall=157 success=no exit=-1 a0=18 a1=0 a2=1 a3=0 items=0 ppid=1783 pid=1784 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="kerneloops" exe="/usr/sbin/kerneloops" subj=system_u:system_r:kerneloops_t:s0-s0:c0.c1023 key=(null)
This is expected since Dan hasn't written policy for anything not in rawhide. Assuming you are in permissive mode, does everything work as its supposed to? Please note that I need this applied before the beta freeze.
Kerneloops has been obsoleted by abrt