Re: [PATCH refpolicy] udev: allow udevadmin to extend socket recv buffer

On 7/16/2025 4:50 AM, Virendra Thakur wrote:
> From: Virendra Thakur <[email protected]>
> 
> Upstream systemd commit [eba449fa81f6] (PR #29872) modifies udevadm-trigger
> and sd-device-monitor to unconditionally increase the receive buffer size
> on netlink sockets. This helps avoid failures under high event loads,
> such as:
> wait-for-udev: Failed to increase receive buffer size, ignoring: Operation not permitted
> 
> To address: "wait-for-udev: Failed to increase receive buffer size, ignoring:
> Operation not permitted", we need to allow udevadm to increase the buffer.
> This may fix the issue that udevadm trigger hangs while processing the events

It seems you're unsure if this fixes the issue.  Can you confirm it 
does?  I'd rather not merge this until we know for sure.



> References:
> - https://github.com/systemd/systemd/pull/29872
> 
> To support this in SELinux, Allow udevadm to use CAP_NET_ADMIN to extend
> the socket receive buffer to hold more events.
> 
> Signed-off-by: Virendra Thakur <[email protected]>
> ---
>   policy/modules/system/udev.te | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
> index 64aeafea6..2f3d6f8d7 100644
> --- a/policy/modules/system/udev.te
> +++ b/policy/modules/system/udev.te
> @@ -443,3 +443,6 @@ seutil_read_file_contexts(udevadm_t)
>   storage_getattr_fixed_disk_dev(udevadm_t)
>   
>   userdom_use_user_terminals(udevadm_t)
> +
> +# Allow udevadm to use CAP_NET_ADMIN to extend the socket receive buffer to hold more events
> +allow udevadm_t self:capability { net_admin };

If this fixes the issue, please move this with the existing capability rule.


-- 
Chris PeBenito