[meta-selinux][PATCH] refpolicy: allow seatd to use unallocated TTYs

seatd requires access to unallocated TTY devices such as /dev/tty0
to manage seat activation and VT handling for Wayland compositors.

Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/pull/1114]

Signed-off-by: Jaihind Yadav <[email protected]>
---
 ...ervices-seatd-to-use-unallocated_tty.patch | 27 +++++++++++++++++++
 .../refpolicy/refpolicy_common.inc            |  1 +
 2 files changed, 28 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy/0060-policy-modules-services-seatd-to-use-unallocated_tty.patch

diff --git a/recipes-security/refpolicy/refpolicy/0060-policy-modules-services-seatd-to-use-unallocated_tty.patch b/recipes-security/refpolicy/refpolicy/0060-policy-modules-services-seatd-to-use-unallocated_tty.patch
new file mode 100644
index 0000000..b5bc03b
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy/0060-policy-modules-services-seatd-to-use-unallocated_tty.patch
@@ -0,0 +1,27 @@
+From 9b060b28f151316c38dd16068644cbd04969e93d Mon Sep 17 00:00:00 2001
+From: Jaihind Yadav <[email protected]>
+Date: Tue, 12 May 2026 11:23:17 +0530
+Subject: [PATCH] refpolicy: allow seatd to use unallocated TTYs
+
+seatd requires access to unallocated TTY devices such as /dev/tty0
+to manage seat activation and VT handling for Wayland compositors.
+
+Upstream-Status: Backport [https://github.com/SELinuxProject/refpolicy/pull/1114]
+
+Signed-off-by: Jaihind Yadav <[email protected]>
+---
+ policy/modules/services/seatd.te | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/policy/modules/services/seatd.te b/policy/modules/services/seatd.te
+index 44ba85ee7..d539dc446 100644
+--- a/policy/modules/services/seatd.te
++++ b/policy/modules/services/seatd.te
+@@ -32,3 +32,7 @@ auth_use_nsswitch(seatd_t)
+ 
+ dev_rw_dri(seatd_t)
+ dev_rw_input_dev(seatd_t)
++
++# seatd requires access to unallocated TTYs (e.g. /dev/tty0) to manage
++# seat activation and VT handling for Wayland compositors.
++term_use_unallocated_ttys(seatd_t)
diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index 6f528d5..9e3b672 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -75,6 +75,7 @@ SRC_URI += " \
         file://0057-policy-modules-system-systemd-make-_systemd_t-MLS-tr.patch \
         file://0058-policy-modules-system-logging-make-syslogd_runtime_t.patch \
         file://0059-policy-modules-system-init-allow-ModemManager-to-sen.patch \
+        file://0060-policy-modules-services-seatd-to-use-unallocated_tty.patch \ 
         "
 
 S = "${UNPACKDIR}/refpolicy"
-- 
2.43.0