selinux-policy: Add checkpoint restore for getty. (#8879)

Signed-off-by: Chris PeBenito <[email protected]>

SPECS/selinux-policy/0042-getty-grant-checkpoint_restore.patch

@@ -0,0 +1,33 @@
+From 46192c98e771f5120b62c6ab36dc1245424e7cd4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <[email protected]>
+Date: Thu, 28 Mar 2024 20:01:49 +0100
+Subject: [PATCH 41/41] getty: grant checkpoint_restore
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Since Linux 6.7 checkpoint-restore functionality is guareded via the
+capability CAP_CHECKPOINT_RESTORE, with a fallback to CAP_SYS_ADMIN.
+Grant the new capability while keeping the old one for backwards
+compatibility.
+
+Signed-off-by: Christian Göttsche <[email protected]>
+---
+ policy/modules/system/getty.te | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te
+index bbc83a807..a900226bf 100644
+--- a/policy/modules/system/getty.te
++++ b/policy/modules/system/getty.te
+@@ -34,6 +34,7 @@ files_tmp_file(getty_tmp_t)
+ # Use capabilities.
+ allow getty_t self:capability { chown dac_override fowner fsetid setgid sys_admin sys_resource sys_tty_config };
+ dontaudit getty_t self:capability sys_tty_config;
++allow getty_t self:capability2 checkpoint_restore;
+ allow getty_t self:process { getpgid getsession setpgid signal_perms };
+ allow getty_t self:fifo_file rw_fifo_file_perms;
+
+-- 
+2.44.0
+

SPECS/selinux-policy/selinux-policy.spec

@@ -9,7 +9,7 @@
 Summary:        SELinux policy
 Name:           selinux-policy
 Version:        %{refpolicy_major}.%{refpolicy_minor}
-Release:        5%{?dist}
+Release:        6%{?dist}
 License:        GPLv2
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -60,6 +60,7 @@ Patch38:        0038-systemd-Fix-run-systemd-shutdown-handling.patch
 Patch39:        0039-modutils-Temporary-fix-for-mkinitrd-dracut.patch
 Patch40:        0040-For-systemd-hostnamed-service-to-run.patch
 Patch41:        0041-docker-Silence-io.containerd.internal.v1.opt-opt-con.patch
+Patch42:        0042-getty-grant-checkpoint_restore.patch
 BuildRequires:  bzip2
 BuildRequires:  checkpolicy >= %{CHECKPOLICYVER}
 BuildRequires:  m4
@@ -345,6 +346,9 @@ exit 0
 selinuxenabled && semodule -nB
 exit 0
 %changelog
+* Tue Apr 23 2024 Chris PeBenito <[email protected]> - 2.20221101-6
+- Add getty fix for new check in kernel 6.7
+
 * Tue Oct 17 2023 Chris PeBenito <[email protected]> - 2.20221101-5
 - Silence noise in containerd io.containerd.internal.v1.opt plugin.