47 lines
2.4 KiB
Diff
47 lines
2.4 KiB
Diff
From 7d20b237ff092cd615045ff25a3d0c9c741f145d Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Fri, 9 Sep 2022 17:22:52 +0200
|
|
Subject: [PATCH] Allow login_userdomain write to boltd named pipes
|
|
|
|
Addresses the following AVC denial:
|
|
|
|
type=PROCTITLE msg=audit(5.9.2022 23:01:30.921:15103) : proctitle=systemd-stdio-bridge -punix:path=/run/user/1000/bus
|
|
type=PATH msg=audit(5.9.2022 23:01:30.921:15103) : item=0 name= inode=32185282 dev=00:08 mode=socket,777 ouid=root ogid=root rdev=00:00 obj=unconfined_u:unconfined_r:rpm_script_t:s0-s0:c0.c1023 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
|
|
type=SYSCALL msg=audit(5.9.2022 23:01:30.921:15103) : arch=x86_64 syscall=newfstatat success=yes exit=0 a0=0x0 a1=0x7f7a005b7093 a2=0x7fff374a7080 a3=0x1000 items=1 ppid=1 pid=1870519 auid=username uid=username gid=username euid=username suid=username fsuid=username egid=username sgid=username fsgid=username tty=(none) ses=10 comm=systemd-stdio-b exe=/usr/bin/systemd-stdio-bridge subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
|
|
type=AVC msg=audit(5.9.2022 23:01:30.921:15103) : avc: denied { getattr } for pid=1870519 comm=systemd-stdio-b path=socket:[32185282] dev="sockfs" ino=32185282 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:rpm_script_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1
|
|
|
|
Signed-off-by: lujie42 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/contrib/rpm.if | 2 +-
|
|
policy/modules/system/userdomain.te | 3 +++
|
|
2 files changed, 4 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/policy/modules/contrib/rpm.if b/policy/modules/contrib/rpm.if
|
|
index c6833ba7d..ec09e164d 100644
|
|
--- a/policy/modules/contrib/rpm.if
|
|
+++ b/policy/modules/contrib/rpm.if
|
|
@@ -993,5 +993,5 @@ interface(`rpm_script_rw_stream_sockets',`
|
|
type rpm_script_t;
|
|
')
|
|
|
|
- allow $1 rpm_script_t:unix_stream_socket { read write };
|
|
+ allow $1 rpm_script_t:unix_stream_socket { rw_socket_perms };
|
|
')
|
|
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
|
|
index 1cf86a09e..bdccda7ea 100644
|
|
--- a/policy/modules/system/userdomain.te
|
|
+++ b/policy/modules/system/userdomain.te
|
|
@@ -452,6 +452,9 @@ optional_policy(`
|
|
rpc_watch_exports(login_userdomain)
|
|
')
|
|
|
|
+optional_policy(`
|
|
+ rpm_script_rw_stream_sockets(login_userdomain)
|
|
+')
|
|
|
|
optional_policy(`
|
|
systemd_login_watch_pid_dirs(login_userdomain)
|
|
--
|
|
2.27.0
|
|
|