From 34e350500437ab3b7be7858b517e2700e29254c5 Mon Sep 17 00:00:00 2001 From: "Sugar, David" Date: Tue, 15 Jan 2019 03:20:28 +0000 Subject: [PATCH] Interface with systemd_hostnamed over dbus to set hostname type=USER_AVC msg=audit(1547039052.040:558): pid=7159 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.hostname1 member=SetPrettyHostname dest=org.freedesktop.hostname1 spid=7563 tpid=7564 scontext=sysadm_u:sysadm_r:applyconfig_t:s0-s0:c0.c1023 tcontext=system_u:system_r:systemd_hostnamed_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1547039052.040:560): pid=7159 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.29 spid=7564 tpid=7563 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=sysadm_u:sysadm_r:applyconfig_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' Signed-off-by: Dave Sugar --- policy/modules/system/systemd.if | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if index 9c70afc9a..740b3a925 100644 --- a/policy/modules/system/systemd.if +++ b/policy/modules/system/systemd.if @@ -268,6 +268,27 @@ interface(`systemd_read_machines',` allow $1 systemd_machined_var_run_t:file read_file_perms; ') +######################################## +## +## Send and receive messages from +## systemd hostnamed over dbus. +## +## +## +## Domain allowed access. +## +## +# +interface(`systemd_dbus_chat_hostnamed',` + gen_require(` + type systemd_hostnamed_t; + class dbus send_msg; + ') + + allow $1 systemd_hostnamed_t:dbus send_msg; + allow systemd_hostnamed_t $1:dbus send_msg; +') + ######################################## ## ## allow systemd_passwd_agent to inherit fds