[refpolicy] [PATCH 1/1] Denial relabeling /run/systemd/private

David Sugar dsugar at tresys.com
Wed Oct 11 17:48:11 UTC 2017


I am seeing the following denial (in dmesg) during system startup:
[    4.623332] type=1400 audit(1507767947.042:3): avc:  denied  { relabelto } for  pid=1 comm="systemd" name="private" dev="tmpfs" ino=5865 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=sock_file

It appears that systemd is attempting to relablel the socket file /run/systemd/private to init_var_run_t but doesn't have permission.

Permissions to relabel other object types already granted in the interface files_relabel_all_pids, I have added permission to relabel sock_files in this interface to resolve the issue.

Signed-off-by: Dave Sugar <dsugar at tresys.com>
---
 policy/modules/kernel/files.if | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 41b0b54d..9b804976 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -6755,6 +6755,7 @@ interface(`files_relabel_all_pids',`
 	relabel_dirs_pattern($1, pidfile, pidfile)
 	relabel_files_pattern($1, pidfile, pidfile)
 	relabel_lnk_files_pattern($1, pidfile, pidfile)
+	relabel_sock_files_pattern($1, pidfile, pidfile)
 ')
 
 ########################################
-- 
2.13.5


More information about the refpolicy mailing list