[meta-selinux][styhead][PATCH] refpolicy: locallogin - allow sulogin_t user_tty_device_t rw

[Clayton Casciato <majortomtosourcecontrol@gmail.com>]

Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
---
 ...ystem-locallogin-allow-sulogin_t-use.patch | 79 +++++++++++++++++++
 .../refpolicy/refpolicy_common.inc            |  1 +
 2 files changed, 80 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy/0065-policy-modules-system-locallogin-allow-sulogin_t-use.patch

diff --git a/recipes-security/refpolicy/refpolicy/0065-policy-modules-system-locallogin-allow-sulogin_t-use.patch b/recipes-security/refpolicy/refpolicy/0065-policy-modules-system-locallogin-allow-sulogin_t-use.patch
new file mode 100644
index 0000000..e77ca44
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0065-policy-modules-system-locallogin-allow-sulogin_t-use.patch
@@ -0,0 +1,79 @@
+From ec85df6dceaa0dbdad76b9e3174482518d9aa980 Mon Sep 17 00:00:00 2001
+From: Clayton Casciato <ccasciato@21sw.us>
+Date: Tue, 1 Apr 2025 12:18:56 -0600
+Subject: [PATCH] locallogin: allow sulogin_t user_tty_device_t rw
+
+type=PROCTITLE proctitle=/usr/sbin/sulogin
+
+type=SYSCALL arch=armeb syscall=openat per=PER_LINUX success=yes exit=3
+a0=AT_FDCWD a1=0x4e77d0 a2=O_RDWR|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW a3=0x0
+items=0 ppid=432 pid=433 auid=unset uid=root gid=root euid=root
+suid=root fsuid=root egid=root sgid=root fsgid=root tty=ttyAMA0
+ses=unset comm=sulogin exe=/usr/sbin/sulogin.util-linux
+subj=system_u:system_r:sulogin_t:s0 key=(null)
+
+type=AVC avc:  denied  { open } for  pid=433 comm=sulogin
+path=/dev/ttyAMA0 dev="devtmpfs" ino=2
+scontext=system_u:system_r:sulogin_t:s0
+tcontext=unconfined_u:object_r:user_tty_device_t:s0 tclass=chr_file
+
+type=AVC avc:  denied  { read write } for  pid=433 comm=sulogin
+name=ttyAMA0 dev="devtmpfs" ino=2
+scontext=system_u:system_r:sulogin_t:s0
+tcontext=unconfined_u:object_r:user_tty_device_t:s0 tclass=chr_file
+----
+type=PROCTITLE proctitle=/usr/sbin/sulogin
+
+type=SYSCALL arch=armeb syscall=ioctl per=PER_LINUX success=yes exit=0
+a0=0x3 a1=0x5457 a2=0xbe8cba90 a3=0xbe8cba40 items=0 ppid=432 pid=433
+auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root
+sgid=root fsgid=root tty=ttyAMA0 ses=unset comm=sulogin
+exe=/usr/sbin/sulogin.util-linux subj=system_u:system_r:sulogin_t:s0
+key=(null)
+
+type=AVC avc:  denied  { ioctl } for  pid=433 comm=sulogin
+path=/dev/ttyAMA0 dev="devtmpfs" ino=2 ioctlcmd=0x5457
+scontext=system_u:system_r:sulogin_t:s0
+tcontext=unconfined_u:object_r:user_tty_device_t:s0 tclass=chr_file
+----
+type=PROCTITLE proctitle=/usr/sbin/sulogin
+
+type=SYSCALL arch=armeb syscall=statx per=PER_LINUX success=yes exit=0
+a0=0x0 a1=0xb6f046ac a2=0x1800 a3=0x7ff items=0 ppid=432 pid=433
+auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root
+sgid=root fsgid=root tty=ttyAMA0 ses=unset comm=sulogin
+exe=/usr/sbin/sulogin.util-linux subj=system_u:system_r:sulogin_t:s0
+key=(null)
+
+type=AVC avc:  denied  { getattr } for  pid=433 comm=sulogin
+path=/dev/ttyAMA0 dev="devtmpfs" ino=2
+scontext=system_u:system_r:sulogin_t:s0
+tcontext=unconfined_u:object_r:user_tty_device_t:s0 tclass=chr_file
+
+--
+
+Fedora:
+https://github.com/fedora-selinux/selinux-policy/blob/v41.35/policy/modules/system/locallogin.te#L266
+
+Signed-off-by: Clayton Casciato <ccasciato@21sw.us>
+
+Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/commit/2240e1a89ea61096b64a172c45fa9db73553ac6d]
+
+Signed-off-by: Clayton Casciato <majortomtosourcecontrol@gmail.com>
+---
+ policy/modules/system/locallogin.te | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
+index fcec23010..c370caf2b 100644
+--- a/policy/modules/system/locallogin.te
++++ b/policy/modules/system/locallogin.te
+@@ -276,7 +276,7 @@ seutil_read_default_contexts(sulogin_t)
+ userdom_use_unpriv_users_fds(sulogin_t)
+ 
+ userdom_search_user_home_dirs(sulogin_t)
+-userdom_use_user_ptys(sulogin_t)
++userdom_use_user_terminals(sulogin_t)
+ 
+ sysadm_shell_domtrans(sulogin_t)
+ 
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index c5b41ee..7b6822d 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -80,6 +80,7 @@ SRC_URI += " \
         file://0062-policy-modules-multiple-filetrans-run_machine_id-etc.patch \
         file://0063-policy-modules-system-locallogin-dontaudit-sulogin_t.patch \
         file://0064-policy-modules-system-locallogin-allow-sulogin_t-unc.patch \
+        file://0065-policy-modules-system-locallogin-allow-sulogin_t-use.patch \
         "
 
 S = "${WORKDIR}/refpolicy"