From 84dd4309ad6d644edea2c3cf448f516f4e008c04 Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Tue, 11 Jan 2022 15:17:27 +0100
Subject: [PATCH] Allow sshd read filesystem sysctl files

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/84dd4309ad6d644edea2c3cf448f516f4e008c04
Conflict: NA

This permissions is required when "nofile unlimited" is configured
in the system resources limits for a user.

echo "testuser hard nofile unlimited" >> /etc/security/limits.d/testuser.conf

Resolves: rhbz#2036585
Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/services/ssh.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
index 10126e7..bf988b7 100644
--- a/policy/modules/services/ssh.te
+++ b/policy/modules/services/ssh.te
@@ -303,6 +303,7 @@ allow sshd_t sshd_keytab_t:file read_file_perms;
 
 kernel_search_key(sshd_t)
 kernel_link_key(sshd_t)
+kernel_read_fs_sysctls(sshd_t)
 kernel_read_net_sysctls(sshd_t)
 
 files_search_all(sshd_t)
-- 
1.8.3.1