From: pebenito@ieee.org (Chris PeBenito) Date: Wed, 11 Oct 2017 18:34:43 -0400 Subject: [refpolicy] [PATCH 1/1] Denial relabeling /run/systemd/private In-Reply-To: References: Message-ID: To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On 10/11/2017 01:48 PM, David Sugar via refpolicy wrote: > I am seeing the following denial (in dmesg) during system startup: > [ 4.623332] type=1400 audit(1507767947.042:3): avc: denied { relabelto } for pid=1 comm="systemd" name="private" dev="tmpfs" ino=5865 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=sock_file > > It appears that systemd is attempting to relablel the socket file /run/systemd/private to init_var_run_t but doesn't have permission. > > Permissions to relabel other object types already granted in the interface files_relabel_all_pids, I have added permission to relabel sock_files in this interface to resolve the issue. > > Signed-off-by: Dave Sugar > --- > policy/modules/kernel/files.if | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if > index 41b0b54d..9b804976 100644 > --- a/policy/modules/kernel/files.if > +++ b/policy/modules/kernel/files.if > @@ -6755,6 +6755,7 @@ interface(`files_relabel_all_pids',` > relabel_dirs_pattern($1, pidfile, pidfile) > relabel_files_pattern($1, pidfile, pidfile) > relabel_lnk_files_pattern($1, pidfile, pidfile) > + relabel_sock_files_pattern($1, pidfile, pidfile) > ') > > ######################################## I think the interface already has more access than it should. This rule should be a new interface. -- Chris PeBenito