From: pebenito@ieee.org (Chris PeBenito)
Date: Thu, 12 Oct 2017 17:48:02 -0400
Subject: [refpolicy] [PATCH 1/1-v2] Denial relabeling
	/run/systemd/private
In-Reply-To: <CO1PR15MB10324A7087460504703CEB31B94B0@CO1PR15MB1032.namprd15.prod.outlook.com>
References: <CO1PR15MB10324A7087460504703CEB31B94B0@CO1PR15MB1032.namprd15.prod.outlook.com>
Message-ID: <5b16159a-98c2-e8b2-e1d7-0139a34ccadf@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 10/12/2017 12:16 PM, David Sugar via refpolicy wrote:
> I am seeing the following denial (in dmesg) during system startup:
> [    4.623332] type=1400 audit(1507767947.042:3): avc:  denied  { relabelto } for  pid=1 comm="systemd" name="private" dev="tmpfs" ino=5865 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=sock_file
> 
> It appears that systemd is attempting to relablel the socket file /run/systemd/private to init_var_run_t but doesn't have permission.
> 
> Updated to create new interface for relabeling of sock_files rather than adding to existing interface
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   policy/modules/kernel/files.if | 19 +++++++++++++++++++
>   policy/modules/system/init.te  |  1 +
>   2 files changed, 20 insertions(+)
> 
> diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
> index 41b0b54d..1dd3f6eb 100644
> --- a/policy/modules/kernel/files.if
> +++ b/policy/modules/kernel/files.if
> @@ -6739,6 +6739,25 @@ interface(`files_relabel_all_pid_dirs',`
>   
>   ########################################
>   ## <summary>
> +##	Relabel to/from all var_run (pid) socket files
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain alloed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`files_relabel_all_pid_sock_files',`
> +	gen_require(`
> +		attribute pidfile;
> +	')
> +
> +	relabel_sock_files_pattern($1, pidfile, pidfile)
> +')
> +
> +
> +########################################
> +## <summary>
>   ##	Relabel to/from all var_run (pid) files and directories
>   ## </summary>
>   ## <param name="domain">
> diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
> index dbc31d1d..be5157d4 100644
> --- a/policy/modules/system/init.te
> +++ b/policy/modules/system/init.te
> @@ -279,6 +279,7 @@ ifdef(`init_systemd',`
>   	files_mounton_root(init_t)
>   	files_search_pids(init_t)
>   	files_relabel_all_pids(init_t)
> +	files_relabel_all_pid_sock_files(init_t)
>   	files_relabelto_etc_runtime_dirs(init_t)
>   	files_relabelto_etc_runtime_files(init_t)
>   	files_read_all_locks(init_t)

Merged.

-- 
Chris PeBenito