Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Dominick Grift <dac.override@gmail.com>
To:     Russell Coker <russell@coker.com.au>
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: /run/systemd/inaccessible
References: <6385652.IY5x3zMeex@xev>
Date:   Thu, 27 Feb 2020 13:20:49 +0100
In-Reply-To: <6385652.IY5x3zMeex@xev> (Russell Coker's message of "Thu, 27 Feb
        2020 21:39:29 +1100")
Message-ID: <87zhd4b4ri.fsf@gmail.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

Russell Coker <russell@coker.com.au> writes:

> allow systemd_logind_t init_var_run_t:chr_file write;
>
> audit2allow shows me that the above is attempted on Debian/Unstable.  What's 
> this inaccessible directory about anyway?

systemd-userruntimedir (245) now also creates it in /run/user/%{USERID}

probably used for InaccessiblePath= directive but I am not sure.

>
> # ls -lZ /run/systemd/inaccessible
> total 0
> b---------. 1 root root system_u:object_r:init_var_run_t:s0 0, 0 Feb 27 13:36 
> blk
> c---------. 1 root root system_u:object_r:init_var_run_t:s0 0, 0 Feb 27 13:36 
> chr
> d---------. 2 root root system_u:object_r:init_var_run_t:s0   40 Feb 27 13:36 
> dir
> p---------. 1 root root system_u:object_r:init_var_run_t:s0    0 Feb 27 13:36 
> fifo
> ----------. 1 root root system_u:object_r:init_var_run_t:s0    0 Feb 27 13:36 
> reg
> s---------. 1 root root system_u:object_r:init_var_run_t:s0    0 Feb 27 13:36 
> sock

-- 
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
https://sks-keyservers.net/pks/lookup?op=get&search=0xDA7E521F10F64098
Dominick Grift