refpolicy: seatd: allow self fifo_file read/write for signal handling - #2846
Open
fangwu (fangwu1) wants to merge 1 commit into
Open
refpolicy: seatd: allow self fifo_file read/write for signal handling#2846fangwu (fangwu1) wants to merge 1 commit into
fangwu (fangwu1) wants to merge 1 commit into
Conversation
Dmitry Baryshkov (lumag)
requested changes
Jul 30, 2026
Dmitry Baryshkov (lumag)
left a comment
Dmitry Baryshkov (lumag)
left a comment
Contributor
There was a problem hiding this comment.
Please write readable PR description. Also plesae correct your Git setup to stop using the login name.
Signed-off-by: fangwu fang.wu@oss.qualcomm.com
fangwu (fangwu1)
force-pushed
the
seatd-selinux-fix
branch
from
July 31, 2026 02:34
4de841b to
c83a53c
Compare
Contributor
Author
|
Updated |
seatd uses a self-pipe trick to deliver signals to its event loop. The signal handler writes '\0' to signal_fds[1] (a pipe) to wake up ppoll() in the main loop. Without permission to write to its own fifo_file, SELinux denies the write with EACCES, preventing seatd from processing SIGTERM during shutdown and causing a 90s reboot delay. Verified on iq-x5121-evk (Purwa, X1E80100) with SELinux enforcing. Upstream-Status: Backport [SELinuxProject/refpolicy@a7e7df1] Signed-off-by: Fang Wu <fang.wu@oss.qualcomm.com>
fangwu (fangwu1)
force-pushed
the
seatd-selinux-fix
branch
from
July 31, 2026 09:31
c83a53c to
438f213
Compare
Test Results 79 files ± 0 408 suites - 1 7h 27m 59s ⏱️ - 53m 17s For more details on these failures, see this check. Results for commit 438f213. ± Comparison against base commit 7b36365. This pull request removes 1 test.This pull request skips 2 tests. |
Dmitry Baryshkov (lumag)
approved these changes
Jul 31, 2026
Anuj Mittal (anujm1)
approved these changes
Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
seatd uses a self-pipe trick to deliver signals to its event loop: the signal handler writes \0 to signal_fds[1] to wake up ppoll() in the main loop. Without SELinux
permission to access its own fifo_file, seatd cannot process SIGTERM during shutdown, causing a 90-second reboot delay.
Fix: Add allow seatd_t self:fifo_file rw_fifo_file_perms; to policy/modules/services/seatd.te.
Verified on: iq-x5121-evk (X1E80100) with SELinux in enforcing mode.
Upstream status:
This patch is a temporary backport via .bbappend, following the same pattern as the existing patches in refpolicy-targeted_git.bbappend. It will be dropped once meta-selinux bumps SRCREV_refpolicy to include the upstream fix.