bpfloader: allow bpffs_type:dir setattr
we have CAP_CHOWN but we can't use it
to custom configure directory uid/gid.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I41bdab8d5b7b4cfc5cdc568909c9c6b9947e2bca
diff --git a/private/bpfloader.te b/private/bpfloader.te
index 87fed1a..1f22fb9 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -6,7 +6,7 @@
allow bpfloader kmsg_device:chr_file w_file_perms;
# These permissions are required to pin ebpf maps & programs.
-allow bpfloader bpffs_type:dir { add_name create remove_name search write };
+allow bpfloader bpffs_type:dir { add_name create remove_name search setattr write };
allow bpfloader bpffs_type:file { create getattr read rename setattr };
allow bpfloader bpffs_type:lnk_file { create getattr read };
allow { bpffs_type -fs_bpf } fs_bpf:filesystem associate;
@@ -29,8 +29,8 @@
###
# Note: we don't care about getattr/mounton/search
-neverallow { domain } bpffs_type:dir ~{ add_name create getattr mounton remove_name search write };
-neverallow { domain -bpfloader } bpffs_type:dir { add_name create remove_name write };
+neverallow { domain } bpffs_type:dir ~{ add_name create getattr mounton remove_name search setattr write };
+neverallow { domain -bpfloader } bpffs_type:dir { add_name create remove_name setattr write };
neverallow { domain } bpffs_type:file ~{ create getattr map open read rename setattr write };
neverallow { domain -bpfloader } bpffs_type:file { create map open rename setattr };