From: dsugar@tresys.com (David Sugar) Date: Thu, 12 Oct 2017 16:16:17 +0000 Subject: [refpolicy] [PATCH 1/1-v2] Denial relabeling /run/systemd/private Message-ID: To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com I am seeing the following denial (in dmesg) during system startup: [ 4.623332] type=1400 audit(1507767947.042:3): avc: denied { relabelto } for pid=1 comm="systemd" name="private" dev="tmpfs" ino=5865 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=sock_file It appears that systemd is attempting to relablel the socket file /run/systemd/private to init_var_run_t but doesn't have permission. Updated to create new interface for relabeling of sock_files rather than adding to existing interface Signed-off-by: Dave Sugar --- policy/modules/kernel/files.if | 19 +++++++++++++++++++ policy/modules/system/init.te | 1 + 2 files changed, 20 insertions(+) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index 41b0b54d..1dd3f6eb 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -6739,6 +6739,25 @@ interface(`files_relabel_all_pid_dirs',` ######################################## ## +## Relabel to/from all var_run (pid) socket files +## +## +## +## Domain alloed access. +## +## +# +interface(`files_relabel_all_pid_sock_files',` + gen_require(` + attribute pidfile; + ') + + relabel_sock_files_pattern($1, pidfile, pidfile) +') + + +######################################## +## ## Relabel to/from all var_run (pid) files and directories ## ## diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index dbc31d1d..be5157d4 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -279,6 +279,7 @@ ifdef(`init_systemd',` files_mounton_root(init_t) files_search_pids(init_t) files_relabel_all_pids(init_t) + files_relabel_all_pid_sock_files(init_t) files_relabelto_etc_runtime_dirs(init_t) files_relabelto_etc_runtime_files(init_t) files_read_all_locks(init_t) -- 2.13.5