Laurent Bigonville 8f4f9a924a Allow udevadm to read files in /run/udev/data ... With this commit, my basic debian buster installation is booting type=PROCTITLE msg=audit(09/09/19 08:23:24.011:69) : proctitle=/bin/udevadm trigger --type=devices --action=add type=PATH msg=audit(09/09/19 08:23:24.011:69) : item=0 name=/run/udev/data/+platform:QEMU0002:00 inode=12584 dev=00:15 mode=file,644 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:udev_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=CWD msg=audit(09/09/19 08:23:24.011:69) : cwd=/ type=SYSCALL msg=audit(09/09/19 08:23:24.011:69) : arch=x86_64 syscall=openat success=yes exit=5 a0=0xffffff9c a1=0x7fff993f0cb0 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=486 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=udevadm exe=/usr/bin/udevadm subj=system_u:system_r:udevadm_t:s0 key=(null) type=AVC msg=audit(09/09/19 08:23:24.011:69) : avc: denied { open } for pid=486 comm=udevadm path=/run/udev/data/+platform:QEMU0002:00 dev="tmpfs" ino=12584 scontext=system_u:system_r:udevadm_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1 type=AVC msg=audit(09/09/19 08:23:24.011:69) : avc: denied { read } for pid=486 comm=udevadm name=+platform:QEMU0002:00 dev="tmpfs" ino=12584 scontext=system_u:system_r:udevadm_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1 Signed-off-by: Laurent Bigonville <bigon@bigon.be>		2019-09-09 08:25:16 +02:00
..
flask	Remove incorrect comment about capability2:mac_admin.	2019-03-11 20:49:42 -04:00
modules	Allow udevadm to read files in /run/udev/data	2019-09-09 08:25:16 +02:00
support	obj_perm_sets.spt: Add xdp_socket to socket_class_set.	2018-10-23 17:18:43 -04:00
constraints	refpolicy: Update for kernel sctp support	2018-03-21 14:14:37 -04:00
context_defaults	Fix error in default_user example.	2014-04-28 10:19:22 -04:00
global_booleans	Move secure_mode_policyload into selinux module as that is the only place it is used.	2011-09-26 09:53:23 -04:00
global_tunables	user_udp_server tunable	2016-08-02 19:44:16 -04:00
mcs	refpolicy: Update for kernel sctp support	2018-03-21 14:14:37 -04:00
mls	Remove unused translate permission in context userspace class.	2018-10-13 13:39:18 -04:00
policy_capabilities	Enable cgroup_seclabel and nnp_nosuid_transition.	2018-01-16 18:52:39 -05:00
users	Apply direct_initrc to unconfined_r:unconfined_t	2014-01-16 15:27:18 -05:00