Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
From:   rishi gupta <gupt21@gmail.com>
Date:   Fri, 6 Nov 2020 17:52:55 +0530
Message-ID: <CALUj-gt8KD4Cc-zgvXP-8vNdR3RB_Sdx7yd2cv7GX_wBCM6gEQ@mail.gmail.com>
Subject: Selinux policy for x509_ima.der public certificate loaded by kernel
 during boot
To:     linux-integrity <linux-integrity@vger.kernel.org>,
        selinux-refpolicy@vger.kernel.org, selinux@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

I am getting below error as selinux is denying access to the .ima
keyring. Looking for guidance for asymmetric public key selinux
policy.

[  172.014855] integrity: Request for unknown key 'id:87deb3bf' err -13

[  172.015035] audit: type=1800 audit(1604596570.579:240): pid=825
uid=1021 auid=4294967295 ses=4294967295
subj=system_u:system_r:mydaemon_t:s0-s15:c0.c1023 op="appraise_data"
cause="invalid-signature" comm="mydaemon"
name="/usr/lib/libstdc++.so.6.0.25" dev="ubifs" ino=14353 res=0

(a) Do I need to set the selinux context of file
/etc/keys/x509_ima.der. If yes what it should be.
(b) Do I need to set some selinux rule for .ima keyring. If yes how. I
tried a lot but could not find any resource.

Regards,
Rishi