37 lines
2.0 KiB
Diff
37 lines
2.0 KiB
Diff
From dc983b88ad1043c43de1cc19d579debcd10a778d Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Tue, 15 Feb 2022 11:44:23 +0100
|
|
Subject: [PATCH] Allow userdomain read symlinks in /var/lib
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/dc983b88ad1043c43de1cc19d579debcd10a778d
|
|
Conflict: NA
|
|
|
|
Addresses the following AVC denial:
|
|
|
|
type=PROCTITLE msg=audit(02/15/22 11:39:56.020:247) : proctitle=/usr/bin/gnome-software --gapplication-service
|
|
type=PATH msg=audit(02/15/22 11:39:56.020:247) : item=0 name=/var/lib/flatpak/appstream/flathub/x86_64/active/appstream.xml.gz nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
|
|
type=CWD msg=audit(02/15/22 11:39:56.020:247) : cwd=/home/user
|
|
type=SYSCALL msg=audit(02/15/22 11:39:56.020:247) : arch=x86_64 syscall=access success=no exit=EACCES(Permission denied) a0=0x7fb66c6f8da0 a1=F_OK a2=0x0 a3=0x20 items=1 ppid=1460 pid=2035 auid=user uid=user gid=user euid=user suid=user fsuid=user egid=user sgid=user fsgid=user tty=(none) ses=3 comm=pool-org.gnome. exe=/usr/bin/gnome-software subj=user_u:user_r:user_t:s0 key=(null)
|
|
type=AVC msg=audit(02/15/22 11:39:56.020:247) : avc: denied { read } for pid=2035 comm=pool-org.gnome. name=active dev="vda2" ino=387091 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=lnk_file permissive=0
|
|
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/system/userdomain.te | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
|
|
index 69b460f..3ac8c12 100644
|
|
--- a/policy/modules/system/userdomain.te
|
|
+++ b/policy/modules/system/userdomain.te
|
|
@@ -387,6 +387,7 @@ tunable_policy(`deny_bluetooth',`',`
|
|
dev_watch_generic_dirs(login_userdomain)
|
|
|
|
files_map_var_lib_files(login_userdomain)
|
|
+files_read_var_lib_symlinks(login_userdomain)
|
|
files_watch_etc_dirs(login_userdomain)
|
|
files_watch_etc_files(login_userdomain)
|
|
files_watch_system_conf_dirs(login_userdomain)
|
|
--
|
|
1.8.3.1
|
|
|