systemd: allow daemons to access memory.pressure
These services are hooked up to the memory.pressure interface, so
allow them to access the file.
Jan 26 08:12:21 localhost audit[202]: AVC avc: denied { getattr } for pid=202 comm="systemd-journal" path="/sys/fs/cgroup/system.slice/systemd-journald.service/memory.pressure" dev="cgroup2" ino=557 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[379]: AVC avc: denied { getattr } for pid=379 comm="systemd-resolve" path="/sys/fs/cgroup/system.slice/systemd-resolved.service/memory.pressure" dev="cgroup2" ino=1463 scontext=system_u:system_r:systemd_resolved_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Mar 10 19:49:01 localhost audit[475]: AVC avc: denied { getattr } for pid=475 comm="systemd-network" path="/sys/fs/cgroup/system.slice/systemd-networkd.service/memory.pressure" dev="cgroup2" ino=1595 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Mar 10 19:49:02 localhost audit[491]: AVC avc: denied { getattr } for pid=491 comm="systemd-portabl" path="/sys/fs/cgroup/system.slice/systemd-portabled.service/memory.pressure" dev="cgroup2" ino=1859 scontext=system_u:system_r:systemd_portabled_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Mar 10 19:49:02 localhost audit[490]: AVC avc: denied { write } for pid=490 comm="systemd-logind" name="memory.pressure" dev="cgroup2" ino=1826 scontext=system_u:system_r:systemd_logind_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[202]: AVC avc: denied { getattr } for pid=202 comm="systemd-journal" path="/sys/fs/cgroup/system.slice/systemd-journald.service/memory.pressure" dev="cgroup2" ino=557 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[382]: AVC avc: denied { getattr } for pid=382 comm="systemd-resolve" path="/sys/fs/cgroup/system.slice/systemd-resolved.service/memory.pressure" dev="cgroup2" ino=1463 scontext=system_u:system_r:systemd_resolved_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Mar 10 19:57:56 localhost audit[479]: AVC avc: denied { getattr } for pid=479 comm="systemd-network" path="/sys/fs/cgroup/system.slice/systemd-networkd.service/memory.pressure" dev="cgroup2" ino=1595 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Mar 10 19:57:56 localhost audit[493]: AVC avc: denied { getattr } for pid=493 comm="systemd-portabl" path="/sys/fs/cgroup/system.slice/systemd-portabled.service/memory.pressure" dev="cgroup2" ino=1859 scontext=system_u:system_r:systemd_portabled_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Mar 10 19:57:56 localhost audit[492]: AVC avc: denied { write } for pid=492 comm="systemd-logind" name="memory.pressure" dev="cgroup2" ino=1826 scontext=system_u:system_r:systemd_logind_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[204]: AVC avc: denied { getattr } for pid=204 comm="systemd-journal" path="/sys/fs/cgroup/system.slice/systemd-journald.service/memory.pressure" dev="cgroup2" ino=526 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[316]: AVC avc: denied { getattr } for pid=316 comm="systemd-resolve" path="/sys/fs/cgroup/system.slice/systemd-resolved.service/memory.pressure" dev="cgroup2" ino=1234 scontext=system_u:system_r:systemd_resolved_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[359]: AVC avc: denied { getattr } for pid=359 comm="systemd-network" path="/sys/fs/cgroup/system.slice/systemd-networkd.service/memory.pressure" dev="cgroup2" ino=1564 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[350]: AVC avc: denied { write } for pid=350 comm="systemd-logind" name="memory.pressure" dev="cgroup2" ino=1531 scontext=system_u:system_r:systemd_logind_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[203]: AVC avc: denied { getattr } for pid=203 comm="systemd-journal" path="/sys/fs/cgroup/system.slice/systemd-journald.service/memory.pressure" dev="cgroup2" ino=526 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[312]: AVC avc: denied { getattr } for pid=312 comm="systemd-resolve" path="/sys/fs/cgroup/system.slice/systemd-resolved.service/memory.pressure" dev="cgroup2" ino=1234 scontext=system_u:system_r:systemd_resolved_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[351]: AVC avc: denied { getattr } for pid=351 comm="systemd-network" path="/sys/fs/cgroup/system.slice/systemd-networkd.service/memory.pressure" dev="cgroup2" ino=1564 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[342]: AVC avc: denied { write } for pid=342 comm="systemd-logind" name="memory.pressure" dev="cgroup2" ino=1531 scontext=system_u:system_r:systemd_logind_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Jan 26 08:12:21 localhost audit[201]: AVC avc: denied { open } for pid=201 comm="systemd-journal" path="/sys/fs/cgroup/system.slice/systemd-journald.service/memory.pressure" dev="cgroup2" ino=557 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Mar 13 17:00:57 localhost audit[490]: AVC avc: denied { open } for pid=490 comm="systemd-portabl" path="/sys/fs/cgroup/system.slice/systemd-portabled.service/memory.pressure" dev="cgroup2" ino=1859 scontext=system_u:system_r:systemd_portabled_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=0
Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
This commit is contained in:
Luca Boccassi
parent
6ecba6ff80
commit
d0d4e8fd73
@ -156,6 +156,7 @@ ifdef(`init_systemd',`
|
||||
allow ntpd_t self:capability { fowner setpcap };
|
||||
init_read_state(ntpd_t)
|
||||
init_reload(ntpd_t)
|
||||
fs_watch_memory_pressure(ntpd_t)
|
||||
|
||||
# for /var/lib/systemd/clock
|
||||
init_list_var_lib_dirs(ntpd_t)
|
||||
|
||||
@ -549,6 +549,7 @@ ifdef(`init_systemd',`
|
||||
domain_read_all_domains_state(syslogd_t)
|
||||
|
||||
fs_list_cgroup_dirs(syslogd_t)
|
||||
fs_watch_memory_pressure(syslogd_t)
|
||||
|
||||
init_create_runtime_dirs(syslogd_t)
|
||||
init_daemon_runtime_file(syslogd_runtime_t, dir, "syslogd")
|
||||
|
||||
@ -873,6 +873,7 @@ fs_read_efivarfs_files(systemd_logind_t)
|
||||
fs_relabelfrom_tmpfs_dirs(systemd_logind_t)
|
||||
fs_unmount_tmpfs(systemd_logind_t)
|
||||
fs_getattr_xattr_fs(systemd_logind_t)
|
||||
fs_watch_memory_pressure(systemd_logind_t)
|
||||
|
||||
selinux_use_status_page(systemd_logind_t)
|
||||
|
||||
@ -1020,6 +1021,7 @@ fs_getattr_cgroup(systemd_machined_t)
|
||||
fs_getattr_tmpfs(systemd_machined_t)
|
||||
fs_getattr_xattr_fs(systemd_machined_t)
|
||||
fs_read_nsfs_files(systemd_machined_t)
|
||||
fs_watch_memory_pressure(systemd_machined_t)
|
||||
|
||||
selinux_getattr_fs(systemd_machined_t)
|
||||
|
||||
@ -1126,6 +1128,7 @@ files_list_runtime(systemd_networkd_t)
|
||||
fs_getattr_all_fs(systemd_networkd_t)
|
||||
fs_search_cgroup_dirs(systemd_networkd_t)
|
||||
fs_read_nsfs_files(systemd_networkd_t)
|
||||
fs_watch_memory_pressure(systemd_networkd_t)
|
||||
|
||||
auth_use_nsswitch(systemd_networkd_t)
|
||||
|
||||
@ -1248,6 +1251,7 @@ fs_mount_tmpfs(systemd_nspawn_t)
|
||||
fs_remount_tmpfs(systemd_nspawn_t)
|
||||
fs_remount_xattr_fs(systemd_nspawn_t)
|
||||
fs_read_cgroup_files(systemd_nspawn_t)
|
||||
fs_watch_memory_pressure(systemd_nspawn_t)
|
||||
|
||||
term_getattr_generic_ptys(systemd_nspawn_t)
|
||||
term_getattr_pty_fs(systemd_nspawn_t)
|
||||
@ -1505,6 +1509,7 @@ fs_getattr_all_fs(systemd_resolved_t)
|
||||
fs_search_cgroup_dirs(systemd_resolved_t)
|
||||
fs_search_tmpfs(systemd_resolved_t)
|
||||
fs_search_ramfs(systemd_resolved_t)
|
||||
fs_watch_memory_pressure(systemd_resolved_t)
|
||||
|
||||
init_dgram_send(systemd_resolved_t)
|
||||
|
||||
|
||||
@ -143,6 +143,7 @@ fs_read_cgroup_files(udev_t)
|
||||
fs_rw_anon_inodefs_files(udev_t)
|
||||
fs_search_tracefs(udev_t)
|
||||
fs_manage_efivarfs_files(udev_t)
|
||||
fs_watch_memory_pressure(udev_t)
|
||||
|
||||
mls_file_read_all_levels(udev_t)
|
||||
mls_file_write_all_levels(udev_t)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user