From: dsugar@tresys.com (David Sugar) Date: Wed, 11 Oct 2017 17:48:11 +0000 Subject: [refpolicy] [PATCH 1/1] Denial relabeling /run/systemd/private Message-ID: To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com I am seeing the following denial (in dmesg) during system startup: [ 4.623332] type=1400 audit(1507767947.042:3): avc: denied { relabelto } for pid=1 comm="systemd" name="private" dev="tmpfs" ino=5865 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=sock_file It appears that systemd is attempting to relablel the socket file /run/systemd/private to init_var_run_t but doesn't have permission. Permissions to relabel other object types already granted in the interface files_relabel_all_pids, I have added permission to relabel sock_files in this interface to resolve the issue. Signed-off-by: Dave Sugar --- policy/modules/kernel/files.if | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index 41b0b54d..9b804976 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -6755,6 +6755,7 @@ interface(`files_relabel_all_pids',` relabel_dirs_pattern($1, pidfile, pidfile) relabel_files_pattern($1, pidfile, pidfile) relabel_lnk_files_pattern($1, pidfile, pidfile) + relabel_sock_files_pattern($1, pidfile, pidfile) ') ######################################## -- 2.13.5