I am seeing the following denial (in dmesg) during system startup:
[ 4.623332] type=1400 audit(1507767947.042:3): avc: denied { relabelto } for pid=1 comm="systemd" name="private" dev="tmpfs" ino=5865 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=sock_file
It appears that systemd is attempting to relablel the socket file /run/systemd/private to init_var_run_t but doesn't have permission.
Permissions to relabel other object types already granted in the interface files_relabel_all_pids, I have added permission to relabel sock_files in this interface to resolve the issue.
Signed-off-by: Dave Sugar <[email protected]>
---
policy/modules/kernel/files.if | 1 +
1 file changed, 1 insertion(+)
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 41b0b54d..9b804976 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -6755,6 +6755,7 @@ interface(`files_relabel_all_pids',`
relabel_dirs_pattern($1, pidfile, pidfile)
relabel_files_pattern($1, pidfile, pidfile)
relabel_lnk_files_pattern($1, pidfile, pidfile)
+ relabel_sock_files_pattern($1, pidfile, pidfile)
')
########################################
--
2.13.5
On 10/11/2017 01:48 PM, David Sugar via refpolicy wrote:
> I am seeing the following denial (in dmesg) during system startup:
> [ 4.623332] type=1400 audit(1507767947.042:3): avc: denied { relabelto } for pid=1 comm="systemd" name="private" dev="tmpfs" ino=5865 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=sock_file
>
> It appears that systemd is attempting to relablel the socket file /run/systemd/private to init_var_run_t but doesn't have permission.
>
> Permissions to relabel other object types already granted in the interface files_relabel_all_pids, I have added permission to relabel sock_files in this interface to resolve the issue.
>
> Signed-off-by: Dave Sugar <[email protected]>
> ---
> policy/modules/kernel/files.if | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
> index 41b0b54d..9b804976 100644
> --- a/policy/modules/kernel/files.if
> +++ b/policy/modules/kernel/files.if
> @@ -6755,6 +6755,7 @@ interface(`files_relabel_all_pids',`
> relabel_dirs_pattern($1, pidfile, pidfile)
> relabel_files_pattern($1, pidfile, pidfile)
> relabel_lnk_files_pattern($1, pidfile, pidfile)
> + relabel_sock_files_pattern($1, pidfile, pidfile)
> ')
>
> ########################################
I think the interface already has more access than it should. This rule
should be a new interface.
--
Chris PeBenito