1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
From 81e63f86d6d030eaf0204796e32011c08e7b5e52 Mon Sep 17 00:00:00 2001
From: Yi Zhao <yi.zhao@windriver.com>
Date: Tue, 28 Sep 2021 10:03:04 +0800
Subject: [PATCH] policy/modules/system/systemd: allow systemd_*_t to get the
attributes of tmpfs and cgroups
Fixes:
avc: denied { getattr } for pid=245 comm="systemd-network" name="/"
dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
avc: denied { getattr } for pid=252 comm="systemd-resolve" name="/"
dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_resolved_t
tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
avc: denied { getattr } for pid=260 comm="systemd-user-se" name="/"
dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_sessions_t
tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0
avc: denied { search } for pid=293 comm="systemd-user-ru" name="/"
dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_user_runtime_dir_t
tcontext=system_u:object_r:cgroup_t tclass=dir permissive=0
Upstream-Status: Inappropriate [embedded specific]
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
policy/modules/system/systemd.te | 35 ++++++++++++++++++++++++++++++++
1 file changed, 35 insertions(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 448905ff7..847895e63 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -337,6 +337,10 @@ udev_read_runtime_files(systemd_backlight_t)
files_search_var_lib(systemd_backlight_t)
+fs_getattr_tmpfs(systemd_backlight_t)
+fs_search_cgroup_dirs(systemd_backlight_t)
+fs_getattr_cgroup(systemd_backlight_t)
+
#######################################
#
# Binfmt local policy
@@ -447,6 +451,7 @@ files_list_usr(systemd_generator_t)
fs_list_efivars(systemd_generator_t)
fs_getattr_cgroup(systemd_generator_t)
fs_getattr_xattr_fs(systemd_generator_t)
+fs_getattr_tmpfs(systemd_generator_t)
init_create_runtime_files(systemd_generator_t)
init_manage_runtime_dirs(systemd_generator_t)
@@ -515,6 +520,10 @@ systemd_log_parse_environment(systemd_hostnamed_t)
# Allow reading /run/udev/data/+dmi:id
udev_read_runtime_files(systemd_hostnamed_t)
+fs_getattr_tmpfs(systemd_hostnamed_t)
+fs_search_cgroup_dirs(systemd_hostnamed_t)
+fs_getattr_cgroup(systemd_hostnamed_t)
+
optional_policy(`
dbus_connect_system_bus(systemd_hostnamed_t)
dbus_system_bus_client(systemd_hostnamed_t)
@@ -835,6 +844,10 @@ dev_read_sysfs(systemd_modules_load_t)
files_mmap_read_kernel_modules(systemd_modules_load_t)
files_read_etc_files(systemd_modules_load_t)
+fs_getattr_tmpfs(systemd_modules_load_t)
+fs_search_cgroup_dirs(systemd_modules_load_t)
+fs_getattr_cgroup(systemd_modules_load_t)
+
modutils_read_module_config(systemd_modules_load_t)
modutils_read_module_deps(systemd_modules_load_t)
@@ -885,6 +898,7 @@ files_watch_runtime_dirs(systemd_networkd_t)
files_watch_root_dirs(systemd_networkd_t)
files_list_runtime(systemd_networkd_t)
fs_getattr_xattr_fs(systemd_networkd_t)
+fs_getattr_tmpfs(systemd_networkd_t)
fs_getattr_cgroup(systemd_networkd_t)
fs_search_cgroup_dirs(systemd_networkd_t)
fs_read_nsfs_files(systemd_networkd_t)
@@ -1185,6 +1199,10 @@ udev_read_runtime_files(systemd_rfkill_t)
systemd_log_parse_environment(systemd_rfkill_t)
+fs_getattr_tmpfs(systemd_rfkill_t)
+fs_search_cgroup_dirs(systemd_rfkill_t)
+fs_getattr_cgroup(systemd_rfkill_t)
+
#########################################
#
# Resolved local policy
@@ -1224,6 +1242,9 @@ auth_use_nsswitch(systemd_resolved_t)
files_watch_root_dirs(systemd_resolved_t)
files_watch_runtime_dirs(systemd_resolved_t)
files_list_runtime(systemd_resolved_t)
+fs_getattr_tmpfs(systemd_resolved_t)
+fs_search_cgroup_dirs(systemd_resolved_t)
+fs_getattr_cgroup(systemd_resolved_t)
init_dgram_send(systemd_resolved_t)
@@ -1288,6 +1309,10 @@ seutil_read_file_contexts(systemd_sessions_t)
systemd_log_parse_environment(systemd_sessions_t)
+fs_getattr_tmpfs(systemd_sessions_t)
+fs_search_cgroup_dirs(systemd_sessions_t)
+fs_getattr_cgroup(systemd_sessions_t)
+
########################################
#
# sysctl local policy
@@ -1304,6 +1329,9 @@ kernel_rw_all_sysctls(systemd_sysctl_t)
kernel_dontaudit_getattr_proc(systemd_sysctl_t)
files_read_etc_files(systemd_sysctl_t)
+fs_getattr_tmpfs(systemd_sysctl_t)
+fs_search_cgroup_dirs(systemd_sysctl_t)
+fs_getattr_cgroup(systemd_sysctl_t)
systemd_log_parse_environment(systemd_sysctl_t)
@@ -1409,6 +1437,8 @@ fs_getattr_tmpfs(systemd_tmpfiles_t)
fs_getattr_xattr_fs(systemd_tmpfiles_t)
fs_list_tmpfs(systemd_tmpfiles_t)
fs_relabelfrom_tmpfs_dirs(systemd_tmpfiles_t)
+fs_search_cgroup_dirs(systemd_tmpfiles_t)
+fs_getattr_cgroup(systemd_tmpfiles_t)
selinux_get_fs_mount(systemd_tmpfiles_t)
selinux_use_status_page(systemd_tmpfiles_t)
@@ -1497,6 +1527,10 @@ allow systemd_update_done_t systemd_update_run_t:file manage_file_perms;
files_etc_filetrans(systemd_update_done_t, systemd_update_run_t, file)
files_var_filetrans(systemd_update_done_t, systemd_update_run_t, file)
+fs_getattr_tmpfs(systemd_update_done_t)
+fs_search_cgroup_dirs(systemd_update_done_t)
+fs_getattr_cgroup(systemd_update_done_t)
+
kernel_read_kernel_sysctls(systemd_update_done_t)
selinux_use_status_page(systemd_update_done_t)
@@ -1601,6 +1635,7 @@ fs_unmount_tmpfs(systemd_user_runtime_dir_t)
fs_relabelfrom_tmpfs_dirs(systemd_user_runtime_dir_t)
fs_read_cgroup_files(systemd_user_runtime_dir_t)
fs_getattr_cgroup(systemd_user_runtime_dir_t)
+fs_search_cgroup_dirs(systemd_user_runtime_dir_t)
kernel_read_kernel_sysctls(systemd_user_runtime_dir_t)
kernel_dontaudit_getattr_proc(systemd_user_runtime_dir_t)
--
2.17.1
|
