Dave Sugar a0403b52d8 Interfaces needed to support IMA/EVM keys ... I have been working to support IMA/EVM on a system. It requires having keys added to the kernel keyring. Keys added with keyctl and evmctl. I am creating keys in the ima_key_t type. Once the keys are created, many domains then need search permission on the type of the key. The following changes are needed to get things to work. Need to add keys to the kernel keyring (keyctl). type=AVC msg=audit(1585420717.704:1868): avc: denied { write } for pid=8622 comm="keyctl" scontext=system_u:system_r:cleanup_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=key permissive=1 Allow all domains to search key type=AVC msg=audit(1587936822.802:556): avc: denied { search } for pid=5963 comm="kworker/u16:6" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:ima_key_t:s0 tclass=key permissive=1 type=AVC msg=audit(1587936822.804:559): avc: denied { search } for pid=5963 comm="systemd-cgroups" scontext=system_u:system_r:systemd_cgroups_t:s0 tcontext=system_u:object_r:ima_key_t:s0 tclass=key permissive=1 type=AVC msg=audit(1587936822.809:560): avc: denied { search } for pid=5964 comm="(sysctl)" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:ima_key_t:s0 tclass=key permissive=1 type=AVC msg=audit(1587936822.813:562): avc: denied { search } for pid=5964 comm="sysctl" scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:ima_key_t:s0 tclass=key permissive=1 type=AVC msg=audit(1587936823.149:604): avc: denied { search } for pid=5987 comm="setsebool" scontext=system_u:system_r:semanage_t:s0 tcontext=system_u:object_r:ima_key_t:s0 tclass=key permissive=1 Signed-off-by: Dave Sugar <dsugar@tresys.com>		2020-04-29 11:50:16 -04:00
..
flask
modules	Interfaces needed to support IMA/EVM keys	2020-04-29 11:50:16 -04:00
support	Add dnl to end of interface declaration. This reduces the number of blank lines in intermediate files and matches the way templates are defined.	2020-03-16 09:31:57 -04:00
constraints
context_defaults
global_booleans
global_tunables	Make raw memory access tunable	2020-03-16 14:06:16 +02:00
mcs
mls
policy_capabilities	Correct estimate kernel version for polcap genfs_seclabel_symlinks	2020-03-31 17:11:41 +02:00
users