From: Konrad Rzeszutek Wilk <[email protected]>
type=AVC msg=audit(1504637347.487:280): avc: denied { map } for pid=857 comm="xenconsoled" path="/dev/xen/privcmd" dev="devtmpfs" ino=16289 scontext=system_u:system_r:xenconsoled_t:s0
Without this we can't use xenconsole (client) to
talk to xenconsoled (server).
Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
---
policy/modules/kernel/devices.if | 1 +
1 file changed, 1 insertion(+)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 4c47709ff..c9071df8f 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -4984,6 +4984,7 @@ interface(`dev_rw_xen',`
')
rw_chr_files_pattern($1, device_t, xen_device_t)
+ allow $1 xen_device_t:chr_file map;
')
########################################
--
2.13.3
On 10/09/2017 11:53 AM, Konrad Rzeszutek Wilk via refpolicy wrote:
> From: Konrad Rzeszutek Wilk <[email protected]>
>
> type=AVC msg=audit(1504637347.487:280): avc: denied { map } for pid=857 comm="xenconsoled" path="/dev/xen/privcmd" dev="devtmpfs" ino=16289 scontext=system_u:system_r:xenconsoled_t:s0
>
> Without this we can't use xenconsole (client) to
> talk to xenconsoled (server).
>
> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
> ---
> policy/modules/kernel/devices.if | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
> index 4c47709ff..c9071df8f 100644
> --- a/policy/modules/kernel/devices.if
> +++ b/policy/modules/kernel/devices.if
> @@ -4984,6 +4984,7 @@ interface(`dev_rw_xen',`
> ')
>
> rw_chr_files_pattern($1, device_t, xen_device_t)
> + allow $1 xen_device_t:chr_file map;
> ')
>
> ########################################
Merged.
--
Chris PeBenito