[meta-selinux][PATCH3/3] libvirt_leasesh: Added read and search permission on kernel sysctls avc: denied { search } for pid=1393 comm="libvirt_leasesh" name="kernel" dev="proc" ino=3693 scontext=system_u:system_r:virt_leaseshelper_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=dir permissive=0 avc: denied { read } for pid=1363 comm="libvirt_leasesh" name="cap_last_cap" dev="proc" ino=13638 scontext=system_u:system_r:virt_leaseshelper_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file permissive=0 avc: denied { open } for pid=1359 comm="libvirt_leasesh" path="/proc/sys/kernel/cap_last_cap" dev="proc" ino=2909 scontext=system_u:system_r:virt_leaseshelper_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file permissive=0 avc: denied { getattr } for pid=1375 comm="libvirt_leasesh" name="/" dev="proc" ino=1 scontext=system_u:system_r:virt_leaseshelper_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem permissive=0

Upstream-Status: Backport [ https://github.com/SELinuxProject/refpolicy/pull/1117/changes/a7d4c1333edee3ea6b532979ae6d940360489793 ]

Signed-off-by: Gargi Misra <[email protected]>
---
 ...Added-read-and-search-permission-on-.patch | 41 +++++++++++++++++++
 .../refpolicy/refpolicy_common.inc            |  1 +
 2 files changed, 42 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy/0061-libvirt_leasesh-Added-read-and-search-permission-on-.patch

diff --git a/recipes-security/refpolicy/refpolicy/0061-libvirt_leasesh-Added-read-and-search-permission-on-.patch b/recipes-security/refpolicy/refpolicy/0061-libvirt_leasesh-Added-read-and-search-permission-on-.patch
new file mode 100644
index 0000000..1897335
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0061-libvirt_leasesh-Added-read-and-search-permission-on-.patch
@@ -0,0 +1,41 @@
+From 977bd13b26fd697a1a01560908974f8a803deba3 Mon Sep 17 00:00:00 2001
+From: Gargi Misra <[email protected]>
+Date: Wed, 27 May 2026 14:35:23 +0530
+Subject: [PATCH] libvirt_leasesh: Added read and search permission on kernel
+ sysctls avc:  denied  { search } for  pid=1393 comm="libvirt_leasesh"
+ name="kernel" dev="proc" ino=3693
+ scontext=system_u:system_r:virt_leaseshelper_t:s0
+ tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=dir permissive=0 avc: 
+ denied  { read } for  pid=1363 comm="libvirt_leasesh" name="cap_last_cap"
+ dev="proc" ino=13638 scontext=system_u:system_r:virt_leaseshelper_t:s0
+ tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file permissive=0 avc: 
+ denied  { open } for  pid=1359 comm="libvirt_leasesh"
+ path="/proc/sys/kernel/cap_last_cap" dev="proc" ino=2909
+ scontext=system_u:system_r:virt_leaseshelper_t:s0
+ tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file permissive=0 avc: 
+ denied  { getattr } for  pid=1375 comm="libvirt_leasesh" name="/" dev="proc"
+ ino=1 scontext=system_u:system_r:virt_leaseshelper_t:s0
+ tcontext=system_u:object_r:proc_t:s0 tclass=filesystem permissive=0
+
+Upstream-Status: Backport [ https://github.com/SELinuxProject/refpolicy/pull/1117/changes/a7d4c1333edee3ea6b532979ae6d940360489793 ]
+
+Signed-off-by: Gargi Misra <[email protected]>
+---
+ policy/modules/services/virt.te | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
+index 2241a22b5..0f6dc341e 100644
+--- a/policy/modules/services/virt.te
++++ b/policy/modules/services/virt.te
+@@ -1161,6 +1161,7 @@ manage_files_pattern(virt_leaseshelper_t, virt_runtime_t, virt_runtime_t)
+ files_runtime_filetrans(virt_leaseshelper_t, virt_runtime_t, file)
+ 
+ kernel_dontaudit_read_system_state(virt_leaseshelper_t)
++kernel_read_kernel_sysctls(virt_leaseshelper_t)
+ 
+ # Read /sys/devices/system/node/node*/meminfo
+ dev_list_sysfs(virt_leaseshelper_t)
+-- 
+2.43.0
+
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index 2a2cc78..23aadf6 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -76,6 +76,7 @@ SRC_URI += " \
         file://0058-policy-modules-system-logging-make-syslogd_runtime_t.patch \
         file://0059-refpolicy-Addressing-denial-seen-on-alsa.patch \
         file://0060-systemd-coredum-Added-sepolicy-permission-to-read-na.patch \
+        file://0061-libvirt_leasesh-Added-read-and-search-permission-on-.patch \
         "
 
 S = "${UNPACKDIR}/refpolicy"
-- 
2.43.0