Message-ID: <4752015eb0c7f866af4883a67448aa88d05b08d2.camel@ieee.org>
Subject: Re: [PATCH] Allow AIDE to sendto kernel datagram socket
From:   Chris PeBenito <pebenito@ieee.org>
To:     "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Date:   Tue, 26 Feb 2019 19:21:55 -0800
In-Reply-To: <20190225233708.15319-4-dsugar@tresys.com>
References: <20190225233708.15319-1-dsugar@tresys.com>
         <20190225233708.15319-4-dsugar@tresys.com>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.30.5 (3.30.5-1.fc29) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On Mon, 2019-02-25 at 23:37 +0000, Sugar, David wrote:
> type=AVC msg=audit(1550799594.394:205): avc:  denied  { sendto }
> for  pid=7182 comm="aide" path="/dev/log"
> scontext=system_u:system_r:aide_t:s0
> tcontext=system_u:system_r:kernel_t:s0 tclass=unix_dgram_socket
> permissive=1
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>  policy/modules/admin/aide.te | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/policy/modules/admin/aide.te
> b/policy/modules/admin/aide.te
> index 9d3c19ce..6297b60e 100644
> --- a/policy/modules/admin/aide.te
> +++ b/policy/modules/admin/aide.te
> @@ -35,6 +35,8 @@ logging_log_filetrans(aide_t, aide_log_t, file)
>  files_read_all_files(aide_t)
>  files_read_all_symlinks(aide_t)
>  
> +kernel_dgram_send(aide_t)
> +
>  logging_send_audit_msgs(aide_t)
>  logging_send_syslog_msg(aide_t)

I merged this.  Since there are only a few domains with this
permission, I'd rather keep it separate.  Should many more domains need
this access, then we can reassess.

-- 
Chris PeBenito