RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

audit daemon can halt system, allow this to happen. 

auditd can halt the system for several reasons based on configuration.
These mostly revovle around audit partition full issues.  I am seeing
the following denials when attempting to halt the system.

Jan 12 03:38:48 localhost audispd: node=localhost type=USER_AVC msg=audit(1578800328.122:1943): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/poweroff.target" cmdline="/sbin/init 0" scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:power_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
Jan 12 03:38:48 localhost audispd: node=localhost type=USER_AVC msg=audit(1578800328.147:1944): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { status } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/poweroff.target" cmdline="/sbin/init 0" scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:power_unit_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
Jan 12 04:44:54 localhost audispd: node=localhost type=AVC msg=audit(1578804294.103:1923): avc:  denied  { getattr } for  pid=6936 comm="systemctl" path="/run/systemd/system" dev="tmpfs" ino=45 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=dir permissive=1

 v2 - use optional rather than ifdef
 v3 - fix order

Signed-off-by: Dave Sugar <dsugar@tresys.com>
This commit is contained in:
Sugar, David 2020-01-22 12:35:42 +00:00 committed by Chris PeBenito
parent e1ccf0ce02
commit 9a0c9fdd0c
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
policy/modules/system/logging.te
View File

@ -231,6 +231,12 @@ optional_policy(`
seutil_sigchld_newrole(auditd_t)
')
optional_policy(`
init_list_unit_dirs(auditd_t)
systemd_start_power_units(auditd_t)
systemd_status_power_units(auditd_t)
')
optional_policy(`
udev_read_db(auditd_t)
')

20
policy/modules/system/systemd.if
View File

@ -819,6 +819,26 @@ interface(`systemd_start_power_units',`
allow $1 power_unit_t:service start;
')
########################################
## <summary>
## Get the system status information about power units
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_status_power_units',`
gen_require(`
type power_unit_t;
class service status;
')
allow $1 power_unit_t:service status;
')
########################################
## <summary>
## Make the specified type usable for