Re: [PATCH] profiles: allow /proc/self writes for SELinux outside of SELinux profiles

Ionen Wolkens <[email protected]> Mon, 25 May 2026 21:34:14 -0400

Newsgroups	gmane.linux.gentoo.devel
Message-ID	<ahT4lgNBvEZ7xVDY@eversor>

On Tue, May 26, 2026 at 12:46:48AM +0100, Sam James wrote:
> When cross-compiling on a SELinux system where the profile has not yet
> been set for the target (i.e. embedded profile) or where a non-SELinux
> profile has been selected, writes to /proc/thread-self/attr/fscreate
> will be prevented by the sandbox:
> 
> ```
> >>> Completed installing sys-libs/timezone-data-2026b into /usr/alpha-unknown-linux-gnu/tmp/portage/sys-libs/timezone-data-2026b/image
> 
>  * Final size of build directory: 9820 KiB (9.5 MiB)
>  * Final size of installed tree:  2720 KiB (2.6 MiB)
> 
>  * ACCESS DENIED:  open_wr:            /proc/thread-self/attr/fscreate
> sed: warning: failed to set default file creation context to staff_u:object_r:usr_t:s0: Permission denied
>  * ACCESS DENIED:  open_wr:            /proc/thread-self/attr/fscreate
> strip: alpha-unknown-linux-gnu-strip --strip-unneeded -N __gentoo_check_ldflags__ -R .comment -R .GCC.command.line -R .note.gnu.gold-version
>    /usr/bin/zdump
> ```
> 
> I don't see a reason to not allow these through the sandbox on other profiles,
> as it should be harmless.

If we want it everywhere, wouldn't it make more sense to add these to
/etc/sandbox.d/00default or sandbox.conf instead?

profile.bashrc isn't a pmspec-recognized thing anyway, using it beyond
informational bits and sanity-checks isn't great.
-- 
ionen

signature.asc (application/pgp-signature, 525 B)