diff options
| author |   Dave Sugar <dsugar@tresys.com> | 2018-06-06 10:25:06 -0400 |
|---|---|---|
| committer |   Jason Zaman <jason@perfinion.com> | 2018-06-08 17:21:01 +0800 |
| commit | ce92e2974b7ba4eb073097e4a192779147db3b39 (patch) | |
| tree | 7dd8cd85082a1155711c75ddbc74131ddb4e42e2 | |
| parent | Switch all remaining Python references to the Python 3 interpreter. (diff) | |
| download | hardened-refpolicy-ce92e2974b7ba4eb073097e4a192779147db3b39.tar.gz hardened-refpolicy-ce92e2974b7ba4eb073097e4a192779147db3b39.tar.bz2 hardened-refpolicy-ce92e2974b7ba4eb073097e4a192779147db3b39.zip | |
Allow systemd-resolved to read sysctl
type=AVC msg=audit(1527698300.007:150): avc: denied { search } for pid=1193 comm="systemd-resolve" name="net" dev="proc" ino=8515 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir
type=AVC msg=audit(1527698300.007:150): avc: denied { read } for pid=1193 comm="systemd-resolve" name="disable_ipv6" dev="proc" ino=7988 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file
type=AVC msg=audit(1527698300.007:150): avc: denied { open } for pid=1193 comm="systemd-resolve" path="/proc/sys/net/ipv6/conf/all/disable_ipv6" dev="proc" ino=7988 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file
type=AVC msg=audit(1527698300.007:151): avc: denied { getattr } for pid=1193 comm="systemd-resolve" path="/proc/sys/net/ipv6/conf/all/disable_ipv6" dev="proc" ino=7988 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file
type=AVC msg=audit(1527698300.006:148): avc: denied { read } for pid=1193 comm="systemd-resolve" name="disable" dev="sysfs" ino=2111 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file
type=AVC msg=audit(1527698300.006:148): avc: denied { open } for pid=1193 comm="systemd-resolve" path="/sys/module/ipv6/parameters/disable" dev="sysfs" ino=2111 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file
type=AVC msg=audit(1527698300.007:149): avc: denied { getattr } for pid=1193 comm="systemd-resolve" path="/sys/module/ipv6/parameters/disable" dev="sysfs" ino=2111 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file
Signed-off-by: Dave Sugar <dsugar@tresys.com>
| -rw-r--r-- | policy/modules/system/systemd.te | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index 0cf54f54..708b9f23 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -842,8 +842,11 @@ manage_dirs_pattern(systemd_resolved_t, systemd_resolved_var_run_t, systemd_reso manage_files_pattern(systemd_resolved_t, systemd_resolved_var_run_t, systemd_resolved_var_run_t) init_pid_filetrans(systemd_resolved_t, systemd_resolved_var_run_t, dir) +dev_read_sysfs(systemd_resolved_t) + kernel_read_crypto_sysctls(systemd_resolved_t) kernel_read_kernel_sysctls(systemd_resolved_t) +kernel_read_net_sysctls(systemd_resolved_t) corenet_tcp_bind_generic_node(systemd_resolved_t) corenet_tcp_bind_llmnr_port(systemd_resolved_t) |