Resolve denial about logging to journal from chkpwd

type=AVC msg=audit(1553029357.588:513): avc: denied { sendto } for pid=7577 comm="unix_chkpwd" path="/dev/log" scontext=toor_u:staff_r:chkpwd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_dgram_socket permissive=0 Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-03-21 18:29:26 +00:00 · 2019-03-21 18:29:26 +00:00 · 5f14e530ad
parent 9f2b1e2b4c
commit 5f14e530ad
1 changed files with 5 additions and 0 deletions
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@ -144,6 +144,11 @@ ifdef(`distro_ubuntu',`
 	')
 ')

+ifdef(`init_systemd',`
+	# for journald /dev/log
+	kernel_dgram_send(chkpwd_t)
+')
+
 optional_policy(`
 	# apache leaks file descriptors
 	apache_dontaudit_rw_tcp_sockets(chkpwd_t)