From 23f1e4316b7983cbda2ad19a706b93be9da1b806 Mon Sep 17 00:00:00 2001 From: Antoine Tenart Date: Thu, 13 Aug 2020 11:36:54 +0200 Subject: [PATCH] sysnetwork: allow to read network configuration files Fixes: avc: denied { getattr } for pid=55 comm="systemd-udevd" path="/etc/systemd/network" dev="vda" ino=128 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1 avc: denied { getattr } for pid=55 comm="systemd-udevd" path="/etc/systemd/network" dev="vda" ino=128 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1 avc: denied { read } for pid=55 comm="systemd-udevd" name="network" dev="vda" ino=128 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1 avc: denied { read } for pid=55 comm="systemd-udevd" name="network" dev="vda" ino=128 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1 avc: denied { open } for pid=55 comm="systemd-udevd" path="/etc/systemd/network" dev="vda" ino=128 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1 avc: denied { open } for pid=55 comm="systemd-udevd" path="/etc/systemd/network" dev="vda" ino=128 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1 avc: denied { getattr } for pid=59 comm="systemd-network" path="/etc/systemd/network" dev="vda" ino=128 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1 avc: denied { read } for pid=59 comm="systemd-network" name="network" dev="vda" ino=128 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1 avc: denied { open } for pid=59 comm="systemd-network" path="/etc/systemd/network" dev="vda" ino=128 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1 avc: denied { search } for pid=59 comm="systemd-network" name="network" dev="vda" ino=128 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1 avc: denied { getattr } for pid=55 comm="systemd-udevd" path="/etc/systemd/network" dev="vda" ino=128 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:net_conf_t tclass=dir permissive=1 Signed-off-by: Antoine Tenart --- policy/modules/system/sysnetwork.if | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if index 9c1804018..d4dd25c6a 100644 --- a/policy/modules/system/sysnetwork.if +++ b/policy/modules/system/sysnetwork.if @@ -346,6 +346,8 @@ interface(`sysnet_read_config',` ') files_search_etc($1) + files_search_runtime($1) + allow $1 net_conf_t:dir list_dir_perms; allow $1 net_conf_t:file read_file_perms; ifdef(`distro_debian',`