libsepol.sepol_string_to_security_class: unrecognized class user_namespace about refpolicy HOT 4 CLOSED

Apparently you did not understand me.

The problem is not that chromium_t doesn't have 'self:user_namespace create;'
and the problem is that I can't build a module with that permission

F_MAKE is :

export REFMAKE=/usr/share/selinux/$(sestatus |grep Load|grep --color -Ei "[ ]{2,}.*" -o|grep -Eio "[a-z0-9].*")/include/Makefile

#REFMAKE is /usr/share/selinux/refpolicy-freedom1b2830-1677953396/include/Makefile

F_MAKE(){
   make -f $REFMAKE $1.pp && semodule -i $1.pp
}

EEE.te

policy_module(EEE, 1.0)

require {
        type chromium_t;
        class user_namespace create;
}

#============= chromium_t ==============
allow chromium_t self:user_namespace create;

cmd:F_MAKE EEE

Compiling refpolicy-freedom1b2830-1677953396 EEE module
Creating refpolicy-freedom1b2830-1677953396 EEE.pp policy package
rm tmp/EEE.mod tmp/EEE.mod.fc
Failed to resolve allow statement at /var/lib/selinux/refpolicy-freedom1b2830-1677953396/tmp/modules/400/EEE/cil:3
Failed to resolve AST
semodule:  Failed!

and so on for all domains that require user_namespace

from refpolicy.

UDP: I found the solution in your latest commits.
0e1cc1e
Where can I read more about this permission?

from refpolicy.

There isn't too much documentation because it is a new check in Linux 6.1. In short, it controls if a domain can create a user namespace. See https://paul-moore.com/blog/d/2022/12/linux_v61.html

from refpolicy.

Thank you. I read it. We close the topic.

from refpolicy.