nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

zfs: allow zfs to write to exports

Browse Source 
Needed by zfs-mount.service.

type=PROCTITLE msg=audit(1705092131.987:49): proctitle=2F7362696E2F7A6673007368617265002D61
type=SYSCALL msg=audit(1705092131.987:49): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=665f44189eba a2=80042 a3=180 items=0 ppid=1 pid=3082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="zfs" exe="/usr/bin/zfs" subj=system_u:system_r:zfs_t:s0 key=(null)
type=AVC msg=audit(1705092131.987:49): avc:  denied  { write } for  pid=3082 comm="zfs" name="zfs.exports.lock" dev="dm-0" ino=1296 scontext=system_u:system_r:zfs_t:s0 tcontext=system_u:object_r:exports_t:s0 tclass=file permissive=0

Signed-off-by: Kenton Groombridge <concord@gentoo.org>
This commit is contained in:
Kenton Groombridge 2024-01-12 17:06:33 -05:00 committed by 0xC0ncord
parent 8ef4c98c77
commit fbbed63769
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
policy/modules/services/rpc.if
View File

@ -50,6 +50,24 @@ template(`rpc_domain_template',`
auth_use_nsswitch($1_t)
')
########################################
## <summary>
## List export files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`rpc_list_exports',`
gen_require(`
type exports_t;
')
allow $1 exports_t:dir list_dir_perms;
')
########################################
## <summary>
## Do not audit attempts to get

3
policy/modules/services/zfs.te
View File

@ -144,7 +144,10 @@ optional_policy(`
kernel_rw_rpc_sysctls(zfs_t)
rpc_manage_nfs_state_data(zfs_t)
rpc_list_exports(zfs_t)
rpc_create_exports(zfs_t)
rpc_read_exports(zfs_t)
rpc_write_exports(zfs_t)
')
#######################################