Nicolas Iooss a6d13cd456 systemd: allow detecting Windows Subsystem for Linux ... Since systemd 242 (commit 6c8a2c6793), systemd and its services read /proc/sys/kernel/osrelease in order to detect whether they are running in Microsoft's WSL (Windows Subsystem for Linux). This leads to logs such as: type=AVC msg=audit(1568445663.990:10): avc: denied { read } for pid=401 comm="systemd-modules" name="osrelease" dev="proc" ino=13319 scontext=system_u:system_r:systemd_modules_load_t tcontext=system_u:object_r:sysctl_kernel_t tclass=file permissive=1 type=AVC msg=audit(1568445663.990:10): avc: denied { open } for pid=401 comm="systemd-modules" path="/proc/sys/kernel/osrelease" dev="proc" ino=13319 scontext=system_u:system_r:systemd_modules_load_t tcontext=system_u:object_r:sysctl_kernel_t tclass=file permissive=1 type=AVC msg=audit(1568445663.990:11): avc: denied { getattr } for pid=401 comm="systemd-modules" path="/proc/sys/kernel/osrelease" dev="proc" ino=13319 scontext=system_u:system_r:systemd_modules_load_t tcontext=system_u:object_r:sysctl_kernel_t tclass=file permissive=1 Add kernel_read_kernel_sysctls() to services that read /proc/sys/kernel/osrelease. These services have been identified by running "grep osrelease < /var/log/audit/audit.log | audit2allow" on an Arch Linux test system. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>		2019-09-14 14:36:13 +02:00
..
flask	Remove incorrect comment about capability2:mac_admin.	2019-03-11 20:49:42 -04:00
modules	systemd: allow detecting Windows Subsystem for Linux	2019-09-14 14:36:13 +02:00
support	obj_perm_sets.spt: Add xdp_socket to socket_class_set.	2018-10-23 17:18:43 -04:00
constraints
context_defaults
global_booleans
global_tunables
mcs
mls	Remove unused translate permission in context userspace class.	2018-10-13 13:39:18 -04:00
policy_capabilities
users