Re: [PATCH refpolicy] udev: allow udevadmin to extend socket recv buffer

On 7/17/2025 2:26 AM, Virendra Kumar Thakur wrote:
> @Chris PeBenito <mailto:[email protected]> Yes this patch fix the issue.
> 
> May I add net_admin line under this section.
> 
> ########################################
> #
> # udevadm Local policy
> #
> 
> If yes then I can send you v2 patch.

Yes.


> ------------------------------------------------------------------------
> *From:* Chris PeBenito <[email protected]>
> *Sent:* Wednesday, July 16, 2025 9:23 PM
> *To:* Virendra Thakur <[email protected]>
> *Cc:* Virendra Kumar Thakur <[email protected]>; Virendra Kumar 
> Thakur <[email protected]>; SELinux Reference Policy mailing list 
> <[email protected]>
> *Subject:* Re: [PATCH refpolicy] udev: allow udevadmin to extend socket 
> recv buffer
> Caution: This email originated from outside of the KPIT. Do not click 
> links or open attachments unless you recognize the sender and know the 
> content is safe.
> 
> On 7/16/2025 4:50 AM, Virendra Thakur wrote:
>> From: Virendra Thakur <[email protected]>
>>
>> Upstream systemd commit [eba449fa81f6] (PR #29872) modifies udevadm-trigger
>> and sd-device-monitor to unconditionally increase the receive buffer size
>> on netlink sockets. This helps avoid failures under high event loads,
>> such as:
>> wait-for-udev: Failed to increase receive buffer size, ignoring: Operation not permitted
>>
>> To address: "wait-for-udev: Failed to increase receive buffer size, ignoring:
>> Operation not permitted", we need to allow udevadm to increase the buffer.
>> This may fix the issue that udevadm trigger hangs while processing the events
> 
> It seems you're unsure if this fixes the issue.  Can you confirm it
> does?  I'd rather not merge this until we know for sure.
> 
> 
> 
>> References:
>> - https://apc01.safelinks.protection.outlook.com/? 
> url=https%3A%2F%2Fgithub.com%2Fsystemd%2Fsystemd%2Fpull%2F29872&data=05%7C02%7CVirendra.Thakur%40kpit.com%7C570f911d34a44a9f036b08ddc480f60c%7C3539451eb46e4a26a242ff61502855c7%7C0%7C0%7C638882780389210379%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=9oERgV7eLiJOs%2Frxa%2Fx%2BssJ%2BrBtVM0JWpDsiBU4Lhvs%3D&reserved=0 <https://github.com/systemd/systemd/pull/29872>
>>
>> To support this in SELinux, Allow udevadm to use CAP_NET_ADMIN to extend
>> the socket receive buffer to hold more events.
>>
>> Signed-off-by: Virendra Thakur <[email protected]>
>> ---
>>   policy/modules/system/udev.te | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
>> index 64aeafea6..2f3d6f8d7 100644
>> --- a/policy/modules/system/udev.te
>> +++ b/policy/modules/system/udev.te
>> @@ -443,3 +443,6 @@ seutil_read_file_contexts(udevadm_t)
>>   storage_getattr_fixed_disk_dev(udevadm_t)
>>
>>   userdom_use_user_terminals(udevadm_t)
>> +
>> +# Allow udevadm to use CAP_NET_ADMIN to extend the socket receive buffer to hold more events
>> +allow udevadm_t self:capability { net_admin };
> 
> If this fixes the issue, please move this with the existing capability rule.
> 
> 
> --
> Chris PeBenito
> This message contains information that may be privileged or confidential 
> and is the property of the KPIT Technologies Ltd. It is intended only 
> for the person to whom it is addressed. If you are not the intended 
> recipient, you are not authorized to read, print, retain copy, 
> disseminate, distribute, or use this message or any part thereof. If you 
> receive this message in error, please notify the sender immediately and 
> delete all copies of this message. KPIT Technologies Ltd. does not 
> accept any liability for virus infected mails.


-- 
Chris PeBenito