Re: [PATCH] SELinux: Dontaudit access to dri devices

[Johannes Segitz <jsegitz@suse.de>]

[-- Attachment #1: Type: text/plain, Size: 1058 bytes --]

On Tue, Mar 31, 2026 at 09:47:59PM +0200, Stefano Brivio wrote:
> Assuming that the kernel version is >= 5.9 (otherwise we don't have
> close_range() at all), you could try something like this:
> 
> ---
> diff --git a/passt.c b/passt.c
> index f84419c..d5dad4c 100644
> --- a/passt.c
> +++ b/passt.c
> @@ -340,6 +340,8 @@ int main(int argc, char **argv)
>  	struct timespec now;
>  	struct sigaction sa;
>  
> +	close_range(STDERR_FILENO + 1, ~0U, CLOSE_RANGE_UNSHARE);
> +
>  	if (clock_gettime(CLOCK_MONOTONIC, &log_start))
>  		die_perror("Failed to get CLOCK_MONOTONIC time");
>  
> ---

Thanks. I've build an updated package for the reporter and will let you
know once I get feedback from him

Johannes
-- 
GPG Key                EE16 6BCE AD56 E034 BFB3  3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint:    250F 43F5 F7CE 6F1E 9C59  4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Frankenstr. 146, 90461 Nürnberg, Germany
Geschäftsführer: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 870 bytes --]