36 lines
1.3 KiB
Diff
36 lines
1.3 KiB
Diff
From 6c9ef9467ee7e7c9d569a102b05869419409b15e Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Mon, 27 Jun 2022 09:17:43 +0200
|
|
Subject: [PATCH] Allow firewalld read the contents of the sysfs filesystem
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/6c9ef9467ee7e7c9d569a102b05869419409b15e
|
|
Conflict: NA
|
|
|
|
Addresses the following AVC denial which is triggered on the firewalld
|
|
service start when it tries to read /sys/devices/system/cpu/possible:
|
|
|
|
type=AVC msg=audit(1656139734.292:232): avc: denied { read } for pid=1396 comm="firewalld" name="possible" dev="sysfs" ino=46 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0
|
|
|
|
Resolves: rhbz#2101062
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/contrib/firewalld.te | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/policy/modules/contrib/firewalld.te b/policy/modules/contrib/firewalld.te
|
|
index 62cb02c..1c2d25e 100644
|
|
--- a/policy/modules/contrib/firewalld.te
|
|
+++ b/policy/modules/contrib/firewalld.te
|
|
@@ -81,7 +81,7 @@ corecmd_exec_bin(firewalld_t)
|
|
corecmd_exec_shell(firewalld_t)
|
|
|
|
dev_read_urand(firewalld_t)
|
|
-dev_search_sysfs(firewalld_t)
|
|
+dev_read_sysfs(firewalld_t)
|
|
|
|
domain_use_interactive_fds(firewalld_t)
|
|
domain_obj_id_change_exemption(firewalld_t)
|
|
--
|
|
1.8.3.1
|
|
|