mirror of
https://github.com/SELinuxProject/refpolicy
synced 2025-03-30 23:36:28 +00:00
a0403b52d8
I have been working to support IMA/EVM on a system. It
requires having keys added to the kernel keyring. Keys
added with keyctl and evmctl. I am creating keys in the
ima_key_t type. Once the keys are created, many domains
then need search permission on the type of the key. The
following changes are needed to get things to work.
Need to add keys to the kernel keyring (keyctl).
type=AVC msg=audit(1585420717.704:1868): avc: denied { write } for pid=8622 comm="keyctl" scontext=system_u:system_r:cleanup_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=key permissive=1
Allow all domains to search key
type=AVC msg=audit(1587936822.802:556): avc: denied { search } for pid=5963 comm="kworker/u16:6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:ima_key_t:s0 tclass=key permissive=1
type=AVC msg=audit(1587936822.804:559): avc: denied { search } for pid=5963 comm="systemd-cgroups" scontext=system_u:system_r:systemd_cgroups_t:s0 tcontext=system_u:object_r:ima_key_t:s0 tclass=key permissive=1
type=AVC msg=audit(1587936822.809:560): avc: denied { search } for pid=5964 comm="(sysctl)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ima_key_t:s0 tclass=key permissive=1
type=AVC msg=audit(1587936822.813:562): avc: denied { search } for pid=5964 comm="sysctl" scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:ima_key_t:s0 tclass=key permissive=1
type=AVC msg=audit(1587936823.149:604): avc: denied { search } for pid=5987 comm="setsebool" scontext=system_u:system_r:semanage_t:s0 tcontext=system_u:object_r:ima_key_t:s0 tclass=key permissive=1
Signed-off-by: Dave Sugar <dsugar@tresys.com>
|
||
|---|---|---|
| .. | ||
| corecommands.fc | ||
| corecommands.if | ||
| corecommands.te | ||
| corenetwork.fc | ||
| corenetwork.if.in | ||
| corenetwork.if.m4 | ||
| corenetwork.te.in | ||
| corenetwork.te.m4 | ||
| devices.fc | ||
| devices.if | ||
| devices.te | ||
| domain.fc | ||
| domain.if | ||
| domain.te | ||
| files.fc | ||
| files.if | ||
| files.te | ||
| filesystem.fc | ||
| filesystem.if | ||
| filesystem.te | ||
| kernel.fc | ||
| kernel.if | ||
| kernel.te | ||
| mcs.fc | ||
| mcs.if | ||
| mcs.te | ||
| metadata.xml | ||
| mls.fc | ||
| mls.if | ||
| mls.te | ||
| selinux.fc | ||
| selinux.if | ||
| selinux.te | ||
| storage.fc | ||
| storage.if | ||
| storage.te | ||
| terminal.fc | ||
| terminal.if | ||
| terminal.te | ||
| ubac.fc | ||
| ubac.if | ||
| ubac.te | ||