[refpolicy] [PATCH 1/1] Denial relabeling /run/systemd/private

Chris PeBenito pebenito at ieee.org
Wed Oct 11 22:34:43 UTC 2017


On 10/11/2017 01:48 PM, David Sugar via refpolicy wrote:
> I am seeing the following denial (in dmesg) during system startup:
> [    4.623332] type=1400 audit(1507767947.042:3): avc:  denied  { relabelto } for  pid=1 comm="systemd" name="private" dev="tmpfs" ino=5865 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=sock_file
> 
> It appears that systemd is attempting to relablel the socket file /run/systemd/private to init_var_run_t but doesn't have permission.
> 
> Permissions to relabel other object types already granted in the interface files_relabel_all_pids, I have added permission to relabel sock_files in this interface to resolve the issue.
> 
> Signed-off-by: Dave Sugar <dsugar at tresys.com>
> ---
>   policy/modules/kernel/files.if | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
> index 41b0b54d..9b804976 100644
> --- a/policy/modules/kernel/files.if
> +++ b/policy/modules/kernel/files.if
> @@ -6755,6 +6755,7 @@ interface(`files_relabel_all_pids',`
>   	relabel_dirs_pattern($1, pidfile, pidfile)
>   	relabel_files_pattern($1, pidfile, pidfile)
>   	relabel_lnk_files_pattern($1, pidfile, pidfile)
> +	relabel_sock_files_pattern($1, pidfile, pidfile)
>   ')
>   
>   ########################################

I think the interface already has more access than it should.  This rule 
should be a new interface.

-- 
Chris PeBenito


More information about the refpolicy mailing list