Allow local login to read /run/motd
node=localhost type=AVC msg=audit(1689384764.155:53945): avc: denied { getattr } for pid=5125 comm="login" path="/run/motd" dev="tmpfs" ino=1574 scontext=system_u:system_r:local_login_t:s0 tcontext=system_u:object_r:pam_motd_runtime_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1689384764.155:53946): avc: denied { read } for pid=5125 comm="login" name="motd" dev="tmpfs" ino=1574 scontext=system_u:system_r:local_login_t:s0 tcontext=system_u:object_r:pam_motd_runtime_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1689384764.155:53946): avc: denied { open } for pid=5125 comm="login" path="/run/motd" dev="tmpfs" ino=1574 scontext=system_u:system_r:local_login_t:s0 tcontext=system_u:object_r:pam_motd_runtime_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>
This commit is contained in:
parent
bee1bcb496
commit
a120ea8c25
@ -118,6 +118,25 @@ interface(`auth_use_pam_motd_dynamic',`
|
||||
files_runtime_filetrans($1, pam_motd_runtime_t, file, "motd.dynamic.new")
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read the pam module motd with dynamic support during authentication.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`auth_read_pam_motd_dynamic',`
|
||||
gen_require(`
|
||||
type pam_motd_runtime_t;
|
||||
')
|
||||
|
||||
files_search_runtime($1)
|
||||
allow $1 pam_motd_runtime_t:file read_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Make the specified domain used for a login program.
|
||||
|
@ -128,6 +128,7 @@ auth_manage_pam_runtime_dirs(local_login_t)
|
||||
auth_manage_pam_runtime_files(local_login_t)
|
||||
auth_manage_pam_console_data(local_login_t)
|
||||
auth_domtrans_pam_console(local_login_t)
|
||||
auth_read_pam_motd_dynamic(local_login_t)
|
||||
|
||||
init_dontaudit_use_fds(local_login_t)
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user