From mboxrd@z Thu Jan  1 00:00:00 1970
Authentication-Results: passt.top; dmarc=fail (p=none dis=none) header.from=suse.de
Received: from suse-workstation.localdomain (i6DFAB0C4.versanet.de [109.250.176.196])
	by passt.top (Postfix) with ESMTP id 490AC5A0262
	for <passt-dev@passt.top>; Mon, 30 Mar 2026 13:06:21 +0200 (CEST)
Received: by suse-workstation.localdomain (Postfix, from userid 1000)
	id 099D7AE552; Mon, 30 Mar 2026 13:06:21 +0200 (CEST)
From: Johannes Segitz <jsegitz@suse.de>
To: passt-dev@passt.top
Subject: [PATCH] SELinux: Dontaudit access to dri devices
Date: Mon, 30 Mar 2026 13:05:57 +0200
Message-ID: <20260330110557.2569119-1-jsegitz@suse.de>
X-Mailer: git-send-email 2.53.0
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-MailFrom: jsegitz@suse-workstation.localdomain
X-Mailman-Rule-Hits: nonmember-moderation
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation
Message-ID-Hash: NYGCRSK7IKFJC3NRXEMSJ3TQQDGQLPOD
X-Message-ID-Hash: NYGCRSK7IKFJC3NRXEMSJ3TQQDGQLPOD
X-Mailman-Approved-At: Mon, 30 Mar 2026 15:41:42 +0200
CC: Johannes Segitz <jsegitz@suse.de>
X-Mailman-Version: 3.3.8
Precedence: list
List-Id: Development discussion and patches for passt <passt-dev.passt.top>
Archived-At: <https://archives.passt.top/passt-dev/20260330110557.2569119-1-jsegitz@suse.de/>
Archived-At: <https://passt.top/hyperkitty/list/passt-dev@passt.top/message/NYGCRSK7IKFJC3NRXEMSJ3TQQDGQLPOD/>
List-Archive: <https://archives.passt.top/passt-dev/>
List-Archive: <https://passt.top/hyperkitty/list/passt-dev@passt.top/>
List-Help: <mailto:passt-dev-request@passt.top?subject=help>
List-Owner: <mailto:passt-dev-owner@passt.top>
List-Post: <mailto:passt-dev@passt.top>
List-Subscribe: <mailto:passt-dev-join@passt.top>
List-Unsubscribe: <mailto:passt-dev-leave@passt.top>

Currently podman can pass a FD to a DRI device to pasta, leading to AVCs
like this:
avc:  denied  { read write }
comm="pasta" path="/dev/dri/renderD128"
scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023
tcontext=system_u:object_r:dri_device_t:s0
tclass=chr_file
These are harmless, so dontaudit them

Signed-off-by: Johannes Segitz <jsegitz@suse.de>
---
 contrib/selinux/pasta.te | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
index fb51416..4bc7dcc 100644
--- a/contrib/selinux/pasta.te
+++ b/contrib/selinux/pasta.te
@@ -262,3 +262,5 @@ if (pasta_bind_all_ports) {
 	allow pasta_t port_type:tcp_socket { accept getopt name_bind name_connect };
 	allow pasta_t port_type:udp_socket { accept getopt name_bind };
 }
+
+dev_dontaudit_rw_dri(pasta_t)
-- 
2.53.0