[PATCH] udev: allow udevadmin to extend socket recv buffer

From: Bhabu Bindu <[email protected]>

Upstream systemd commit [eba449fa81f6] (PR #29872) modifies udevadm-trigger
and sd-device-monitor to unconditionally increase the receive buffer size
on netlink sockets. This helps avoid failures under high event loads,
such as:
wait-for-udev: Failed to increase receive buffer size, ignoring: Operation not permitted

To address: "wait-for-udev: Failed to increase receive buffer size, ignoring:
Operation not permitted", we need to allow udevadm to increase the buffer.
This may fix the issue that udevadm trigger hangs while processing the events
References:
- https://github.com/systemd/systemd/pull/29872

To support this in SELinux, Allow udevadm to use CAP_NET_ADMIN to extend
the socket receive buffer to hold more events.

Signed-off-by: Bhabu Bindu <[email protected]>
---
 policy/modules/system/udev.te | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index e245a66a4..82fe8354d 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -447,3 +447,6 @@ seutil_read_file_contexts(udevadm_t)
 storage_getattr_fixed_disk_dev(udevadm_t)
 
 userdom_use_user_terminals(udevadm_t)
+
+# Allow udevadm to use CAP_NET_ADMIN to extend the socket receive buffer to hold more events
+allow udevadm_t self:capability { net_admin };
-- 
2.34.1