Christian Göttsche
bdd5036d7a
fix misc typos
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2024-02-22 17:24:25 +01:00
Christian Göttsche
c781fb74c9
support/genhomedircon: support usr prefixed paths
...
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2024-02-22 17:12:56 +01:00
Christian Göttsche
b215f46531
access_vectors: define io_uring { cmd }
...
Added in Linux 6.0.
Link: f4d653dcaa
2024-02-22 17:12:36 +01:00
Chris PeBenito
612a569b5d
Merge pull request #755 from 0xC0ncord/various-20230112
...
Various fixes
2024-02-21 15:47:20 -05:00
Kenton Groombridge
1c534f04b5
kubernetes: allow kubelet to apply fsGroup to persistent volumes
...
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:33:39 -05:00
Kenton Groombridge
fa3cf4f197
container: allow spc to map kubernetes runtime files
...
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:33:39 -05:00
Kenton Groombridge
fb548b6a72
crio: allow reading container home content
...
CRI-O will read container registry configuration data from the running
user's home (root) and will abort if unable to do so.
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:31:37 -05:00
Kenton Groombridge
4634f7a0fe
systemd: allow systemd generator to list exports
...
This is needed now that /etc/exports.d is labeled appropriately.
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:31:37 -05:00
Kenton Groombridge
22b65cba5e
dbus: allow the system bus to get the status of generic units
...
dbus-broker checks the status of systemd-logind.
type=USER_AVC msg=audit(1705109503.237:123): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { status } for auid=n/a uid=0 gid=101 path="/usr/lib /systemd/system/systemd-logind.service" cmdline="/usr/bin/dbus-broker-launch --scope system --audit" function="reply_unit_path" scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=service permissive=1 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:31:37 -05:00
Kenton Groombridge
6d5271cb18
rpc: fix not labeling exports.d directory
...
Fix the filecon for /etc/exports.d to also label the directory itself.
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:31:24 -05:00
Kenton Groombridge
f0fc6cd236
bootloader, init, udev: misc minor fixes
...
Resolve these AVCs seen during early boot with systemd 255:
Jan 12 15:42:02 rem.fuwafuwatime.moe kernel: audit: type=1400 audit(1705092122.714:4): avc: denied { create } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_netfilter_socket permissive=0
Jan 12 15:42:03 rem.fuwafuwatime.moe kernel: audit: type=1400 audit(1705092123.656:7): avc: denied { setrlimit } for pid=2578 comm="systemd-udevd" scontext=system_u:system_r:udev_t:s0 tcontext=system_u:system_r:udev_t:s0 tclass=process permissive=0
Jan 12 15:42:04 rem.fuwafuwatime.moe kernel: audit: type=1400 audit(1705092124.960:9): avc: denied { write } for pid=2629 comm="sysctl" name="nlm_tcpport" dev="proc" ino=31904 scontext=system_u:system_r:udev_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=file permissive=0
Jan 12 15:42:04 rem.fuwafuwatime.moe kernel: audit: type=1400 audit(1705092124.961:10): avc: denied { write } for pid=2629 comm="sysctl" name="nlm_udpport" dev="proc" ino=31905 scontext=system_u:system_r:udev_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=file permissive=0
Jan 12 15:42:04 rem.fuwafuwatime.moe kernel: audit: type=1400 audit(1705092124.963:11): avc: denied { write } for pid=2632 comm="sysctl" name="nlm_tcpport" dev="proc" ino=31904 scontext=system_u:system_r:udev_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=file permissive=0
Jan 12 15:42:08 rem.fuwafuwatime.moe kernel: audit: type=1400 audit(1705092128.530:16): avc: denied { net_admin } for pid=3033 comm="bootctl" capability=12 scontext=system_u:system_r:bootloader_t:s0 tcontext=system_u:system_r:bootloader_t:s0 tclass=capability permissive=0
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:31:08 -05:00
Kenton Groombridge
85fc7fda17
systemd: label systemd-tpm2-setup as systemd-pcrphase
...
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:30:53 -05:00
Kenton Groombridge
4e7511f4ac
init: allow using system bus anon pidfs
...
Seen with systemd 255. This initially did not seem to impact anything,
but after a while I found that the kubernetes kubelet agent would not
start without this access.
type=AVC msg=audit(1705092131.239:37): avc: denied { use } for pid=1 comm="systemd" path="anon_inode:[pidfd]" dev="anon_inodefs" ino=10 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0 tclass=fd permissive=0
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:30:53 -05:00
Kenton Groombridge
29a5cc1abc
kernel: allow managing mouse devices
...
Seen with systemd 255.
type=AVC msg=audit(1705092132.309:64): avc: denied { getattr } for pid=178 comm="kdevtmpfs" path="/input/mouse0" dev="devtmpfs" ino=328 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:mouse_device_t:s0 tclass=chr_file permissive=0
type=AVC msg=audit(1705108275.269:52): avc: denied { setattr } for pid=178 comm="kdevtmpfs" name="mouse0" dev="devtmpfs" ino=327 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:mouse_device_t:s0 tclass=chr_file permissive=0
type=AVC msg=audit(1705108275.269:53): avc: denied { unlink } for pid=178 comm="kdevtmpfs" name="mouse0" dev="devtmpfs" ino=327 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:mouse_device_t:s0 tclass=chr_file permissive=0
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:30:53 -05:00
Kenton Groombridge
fbbed63769
zfs: allow zfs to write to exports
...
Needed by zfs-mount.service.
type=PROCTITLE msg=audit(1705092131.987:49): proctitle=2F7362696E2F7A6673007368617265002D61
type=SYSCALL msg=audit(1705092131.987:49): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=665f44189eba a2=80042 a3=180 items=0 ppid=1 pid=3082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="zfs" exe="/usr/bin/zfs" subj=system_u:system_r:zfs_t:s0 key=(null)
type=AVC msg=audit(1705092131.987:49): avc: denied { write } for pid=3082 comm="zfs" name="zfs.exports.lock" dev="dm-0" ino=1296 scontext=system_u:system_r:zfs_t:s0 tcontext=system_u:object_r:exports_t:s0 tclass=file permissive=0
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:30:53 -05:00
Kenton Groombridge
8ef4c98c77
systemd: label systemd-pcrlock as systemd-pcrphase
...
Label the systemd-pcrlock binary as systemd_pcrphase_exec_t.
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:30:52 -05:00
Kenton Groombridge
29d02c3efa
kubernetes: fix kubelet accounting
...
The kubelet routinely measures metrics and accounting for all
containers which involves calculating resource utilization for both
running containers and the contents of their images on disk.
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:30:25 -05:00
Kenton Groombridge
2912f56e88
container, kubernetes: allow kubernetes to use fuse-overlayfs
...
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:30:24 -05:00
Kenton Groombridge
489051ff99
systemd: add policy for systemd-machine-id-setup
...
systemd-machine-id-setup's role is to commit the host's machine id
to /etc/machine-id. The behavior of this process has changed slightly,
whereby a tmpfs is temporarily created on top of /etc/machine-id during
boot which is then read by systemd-machine-id-setup and written directly
to the underlying file.
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:29:43 -05:00
Kenton Groombridge
8b26a7ccf3
init, systemd: allow systemd-pcrphase to write TPM measurements
...
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-21 15:29:43 -05:00
Chris PeBenito
63698fee31
Merge pull request #756 from 0xC0ncord/rook-ceph
...
Add support for rook-ceph in kubernetes
2024-02-21 14:29:00 -05:00
Chris PeBenito
d11ca7a2b5
Merge pull request #752 from dsugar100/systemd_noatsecure
...
Needed to allow environment variable to process started (for cockpit)
2024-02-21 14:12:29 -05:00
Chris PeBenito
883cfaed99
Merge pull request #754 from yizhao1/systemd
...
Fixes for systemd 255
2024-02-21 14:01:17 -05:00
Kenton Groombridge
1305fd7be1
container: add filecons for rook-ceph
...
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-10 21:10:38 -05:00
Kenton Groombridge
08adc2fadb
kernel: dontaudit read fixed disk devices
...
This is triggered rook-ceph creates its OSDs.
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-09 15:12:00 -05:00
Kenton Groombridge
5ab2cf6a6a
container, kubernetes: add support for rook-ceph
...
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-09 15:11:58 -05:00
Kenton Groombridge
dad409e58b
fstools: allow reading container device blk files
...
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-07 19:20:30 -05:00
Kenton Groombridge
5703d3fdb9
fstools: allow fsadm to ioctl cgroup dirs
...
When kubelet calls losetup, it will transition to the fsadm_t domain and
need to access block devices in containers.
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-07 18:20:35 -05:00
Kenton Groombridge
0bec2f68f7
mount: make mount_runtime_t a kubernetes mountpoint
...
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
2024-02-07 18:18:24 -05:00
Yi Zhao
3d565b0a3a
udev: fix for systemd-udevd
...
Fixes:
avc: denied { setrlimit } for pid=194 comm="systemd-udevd"
scontext=system_u:system_r:udev_t tcontext=system_u:system_r:udev_t
tclass=process permissive=0
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2024-02-04 12:52:54 +08:00
Yi Zhao
9d3513c7fa
systemd: allow systemd-rfkill to getopt from uevent sockets
...
Fixes:
avc: denied { getopt } for pid=313 comm="systemd-rfkill"
scontext=system_u:system_r:systemd_rfkill_t:s0-s15:c0.c1023
tcontext=system_u:system_r:systemd_rfkill_t:s0-s15:c0.c1023
tclass=netlink_kobject_uevent_socket permissive=1
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2024-02-04 11:18:38 +08:00
Yi Zhao
ecc6e3ccde
systemd: allow systemd-hostnamed to read machine-id and localization files
...
Fixes:
avc: denied { read } for pid=533 comm="systemd-hostnam"
name="machine-id" dev="sdb2" ino=196
scontext=system_u:system_r:systemd_hostnamed_t:s0-s15:c0.c1023
tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file permissive=1
avc: denied { open } for pid=533 comm="systemd-hostnam"
path="/etc/machine-id" dev="sdb2" ino=196
scontext=system_u:system_r:systemd_hostnamed_t:s0-s15:c0.c1023
tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file permissive=1
avc: denied { search } for pid=533 comm="systemd-hostnam"
name="zoneinfo" dev="sdb2" ino=22345
scontext=system_u:system_r:systemd_hostnamed_t:s0-s15:c0.c1023
tcontext=system_u:object_r:locale_t:s0 tclass=dir permissive=1
avc: denied { read } for pid=533 comm="systemd-hostnam"
name="Universal" dev="sdb2" ino=22959
scontext=system_u:system_r:systemd_hostnamed_t:s0-s15:c0.c1023
tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=1
avc: denied { open } for pid=533 comm="systemd-hostnam"
path="/usr/share/zoneinfo/Universal" dev="sdb2" ino=22959
scontext=system_u:system_r:systemd_hostnamed_t:s0-s15:c0.c1023
tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=1
avc: denied { getattr } for pid=533 comm="systemd-hostnam"
path="/usr/share/zoneinfo/Universal" dev="sdb2" ino=22959
scontext=system_u:system_r:systemd_hostnamed_t:s0-s15:c0.c1023
tcontext=system_u:object_r:locale_t:s0 tclass=file permissive=1
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2024-02-04 11:07:53 +08:00
Chris PeBenito
504feb7a98
Merge pull request #740 from dsugar100/cockpit
...
Add SELinux policy for cockpit
2024-01-30 14:05:04 -05:00
Dave Sugar
882830d642
Resolve error when cockpit initiate shutdown
...
node=localhost type=AVC msg=audit(1705937785.855:1258): avc: denied { create } for pid=1741 comm="systemd-logind" name=".#scheduleddAhZqh" scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=file permissive=0
node=localhost type=AVC msg=audit(1705937817.548:1268): avc: denied { create } for pid=1741 comm="systemd-logind" name=".#scheduledOLXyXT" scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705937817.548:1268): avc: denied { read write open } for pid=1741 comm="systemd-logind" path="/run/systemd/shutdown/.#scheduledOLXyXT" dev="tmpfs" ino=1803 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705937817.548:1269): avc: denied { setattr } for pid=1741 comm="systemd-logind" name=".#scheduledOLXyXT" dev="tmpfs" ino=1803 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705937817.548:1270): avc: denied { getattr } for pid=1741 comm="systemd-logind" path="/run/systemd/shutdown/.#scheduledOLXyXT" dev="tmpfs" ino=1803 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705937817.548:1271): avc: denied { rename } for pid=1741 comm="systemd-logind" name=".#scheduledOLXyXT" dev="tmpfs" ino=1803 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705937817.549:1272): avc: denied { write } for pid=1741 comm="systemd-logind" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705937817.549:1272): avc: denied { add_name } for pid=1741 comm="systemd-logind" name=".#nologin0EGTLr" scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705937817.549:1273): avc: denied { remove_name } for pid=1741 comm="systemd-logind" name=".#nologin3EGTLr" dev="tmpfs" ino=1804 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=dir permissive=1
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:32:13 -05:00
Dave Sugar
08ea30252e
Fix password changing from cockpit login screen
...
node=localhost type=AVC msg=audit(1705071167.616:1344): avc: denied { write } for pid=6560 comm="cockpit-session" name="etc" dev="dm-1" ino=393220 scontext=system_u:system_r:cockpit_session_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0
node=localhost type=AVC msg=audit(1705071268.820:1383): avc: denied { write } for pid=6588 comm="cockpit-session" name="etc" dev="dm-1" ino=393220 scontext=system_u:system_r:cockpit_session_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705071268.820:1383): avc: denied { add_name } for pid=6588 comm="cockpit-session" name="nshadow" scontext=system_u:system_r:cockpit_session_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705071268.826:1384): avc: denied { remove_name } for pid=6588 comm="cockpit-session" name="nshadow" dev="dm-1" ino=393552 scontext=system_u:system_r:cockpit_session_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:32:13 -05:00
Dave Sugar
d80c8f421f
Denial during cockpit use
...
node=localhost type=USER_AVC msg=audit(1702256090.674:226515): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { status } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/chronyd.service" cmdline="/usr/lib/systemd/systemd-timedated" function="mac_selinux_filter" scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:chronyd_unit_t:s0 tclass=service permissive=0 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?' UID="root" AUID="unset" AUID="root" UID="root" GID="root" SAUID="root"
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:32:08 -05:00
Dave Sugar
a95feb6cdd
Additional access for systemctl
...
Nov 26 16:23:29 localhost.localdomain audisp-syslog[1662]: node=localhost type=AVC msg=audit(1701015809.183:8712): avc: denied { search } for pid=2071 comm="systemctl" name="kernel" dev="proc" ino=5 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=dir permissive=1
Nov 26 16:23:29 localhost.localdomain audisp-syslog[1662]: node=localhost type=AVC msg=audit(1701015809.183:8712): avc: denied { read } for pid=2071 comm="systemctl" name="cap_last_cap" dev="proc" ino=65 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file permissive=1
Nov 26 16:23:29 localhost.localdomain audisp-syslog[1662]: node=localhost type=AVC msg=audit(1701015809.183:8712): avc: denied { open } for pid=2071 comm="systemctl" path="/proc/sys/kernel/cap_last_cap" dev="proc" ino=65 scontext=system_u:system_r:cockpit_ws_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file permissive=1
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
c6d904fcb4
Add watches
...
node=localhost type=AVC msg=audit(1701960388.658:45746): avc: denied { watch } for pid=7282 comm="cockpit-bridge" path="/" dev="dm-1" ino=2 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=0
node=localhost type=AVC msg=audit(1701960389.457:46142): avc: denied { watch } for pid=7282 comm="cockpit-bridge" path="/etc/motd" dev="dm-1" ino=524363 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0
node=localhost type=AVC msg=audit(1701960389.538:46261): avc: denied { watch } for pid=7282 comm="cockpit-bridge" path="/var" dev="dm-9" ino=2 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=0
node=localhost type=AVC msg=audit(1701960389.539:46264): avc: denied { watch } for pid=7282 comm="cockpit-bridge" path="/var/lib" dev="dm-9" ino=262145 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=0
node=localhost type=AVC msg=audit(1701960389.472:46167): avc: denied { watch } for pid=7282 comm="cockpit-bridge" path="/run/systemd" dev="tmpfs" ino=2 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=dir permissive=0
node=localhost type=AVC msg=audit(1701960389.473:46170): avc: denied { watch } for pid=7282 comm="cockpit-bridge" path="/run/systemd/shutdown" dev="tmpfs" ino=99 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=dir permissive=0
node=localhost type=AVC msg=audit(1701966176.317:51985): avc: denied { watch } for pid=7186 comm="cockpit-bridge" path="/run/utmp" dev="tmpfs" ino=94 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=system_u:object_r:initrc_runtime_t:s0 tclass=file permissive=0
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
b4d2d588f8
Add dontaudit to quiet down a bit
...
node=localhost type=AVC msg=audit(1702086779.746:35710): avc: denied { execute } for pid=2790 comm="cockpit-bridge" path=2F6D656D66643A6C6962666669202864656C6574656429 dev="tmpfs" ino=18 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=sysadm_u:object_r:user_tmpfs_t:s0 tclass=file permissive=0
node=localhost type=AVC msg=audit(1702086784.802:36735): avc: denied { execute } for pid=2849 comm="cockpit-bridge" path=2F726F6F742F23363535333931202864656C6574656429 dev="dm-1" ino=655391 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=sysadm_u:object_r:default_t:s0 tclass=file permissive=0
/var/log/audit/audit.log:node=localhost type=AVC msg=audit(1702086784.803:36742): avc: denied { execute } for pid=2849 comm="cockpit-bridge" path=2F233330363834202864656C6574656429 dev="dm-1" ino=30684 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=sysadm_u:object_r:etc_runtime_t:s0 tclass=file permissive=0
node=localhost type=AVC msg=audit(1702069242.629:385266): avc: denied { execute } for pid=5860 comm="cockpit-bridge" path=2F6465762F23373833202864656C6574656429 dev="devtmpfs" ino=783 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=sysadm_u:object_r:device_t:s0 tclass=file permissive=0
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
fcfffd4a2c
Allow key manipulation
...
node=localhost type=AVC msg=audit(1701897597.942:245462): avc: denied { create } for pid=14658 comm="cockpit-session" scontext=system_u:system_r:cockpit_session_t:s0 tcontext=sysadm_u:sysadm_r:sysadm_t:s0 tclass=key permissive=1
node=localhost type=AVC msg=audit(1701897597.942:245464): avc: denied { write } for pid=14658 comm="cockpit-session" scontext=system_u:system_r:cockpit_session_t:s0 tcontext=sysadm_u:sysadm_r:sysadm_t:s0 tclass=key permissive=1
node=localhost type=AVC msg=audit(1701897597.942:245464): avc: denied { search } for pid=14658 comm="cockpit-session" scontext=system_u:system_r:cockpit_session_t:s0 tcontext=sysadm_u:sysadm_r:sysadm_systemd_t:s0-s0:c0.c1023 tclass=key permissive=1
node=localhost type=AVC msg=audit(1701897597.942:245464): avc: denied { link } for pid=14658 comm="cockpit-session" scontext=system_u:system_r:cockpit_session_t:s0 tcontext=sysadm_u:sysadm_r:sysadm_systemd_t:s0-s0:c0.c1023 tclass=key permissive=1
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
b34ce38bfd
admin can read/write web socket
...
node=localhost type=AVC msg=audit(1701889206.489:120065): avc: denied { use } for pid=8735 comm="cockpit-bridge" path="socket:[66969]" dev="sockfs" ino=66969 scontext=staff_u:sysadm_r:sysadm_t:s0 tcontext=system_u:system_r:cockpit_ws_t:s0 tclass=fd permissive=1
node=localhost type=AVC msg=audit(1701889206.489:120065): avc: denied { read write } for pid=8735 comm="cockpit-bridge" path="socket:[66969]" dev="sockfs" ino=66969 scontext=staff_u:sysadm_r:sysadm_t:s0 tcontext=system_u:system_r:cockpit_ws_t:s0 tclass=unix_stream_socket permissive=1
node=localhost type=AVC msg=audit(1701889206.500:120084): avc: denied { ioctl } for pid=8735 comm="cockpit-bridge" path="socket:[66969]" dev="sockfs" ino=66969 ioctlcmd=0x5401 scontext=staff_u:sysadm_r:sysadm_t:s0 tcontext=system_u:system_r:cockpit_ws_t:s0 tclass=unix_stream_socket permissive=1
node=localhost type=AVC msg=audit(1701889207.271:120489): avc: denied { write } for pid=8735 comm="cockpit-bridge" path="socket:[66969]" dev="sockfs" ino=66969 scontext=staff_u:sysadm_r:sysadm_t:s0 tcontext=system_u:system_r:cockpit_ws_t:s0 tclass=unix_stream_socket permissive=1
node=localhost type=AVC msg=audit(1701889207.279:120491): avc: denied { read } for pid=8735 comm="cockpit-bridge" path="socket:[66969]" dev="sockfs" ino=66969 scontext=staff_u:sysadm_r:sysadm_t:s0 tcontext=system_u:system_r:cockpit_ws_t:s0 tclass=unix_stream_socket permissive=1
node=localhost type=AVC msg=audit(1701889217.374:123275): avc: denied { use } for pid=8735 comm="cockpit-bridge" path="socket:[66969]" dev="sockfs" ino=66969 scontext=staff_u:sysadm_r:sysadm_t:s0 tcontext=system_u:system_r:cockpit_ws_t:s0 tclass=fd permissive=1
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
cb810219ba
This works instead of allow exec on user_tmpfs_t!
...
node=localhost type=AVC msg=audit(1702069242.629:385266): avc: denied { execute } for pid=5860 comm="cockpit-bridge" path=2F6465762F23373833202864656C6574656429 dev="devtmpfs" ino=783 scontext=sysadm_u:sysadm_r:sysadm_t:s0 tcontext=sysadm_u:object_r:device_t:s0 tclass=file permissive=0
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
7abf35393b
This seems important for administrative access
...
node=localhost type=AVC msg=audit(1701976221.478:269623): avc: denied { read write } for pid=11016 comm="sudo" path="socket:[138427]" dev="sockfs" ino=138427 scontext=sysadm_u:sysadm_r:sysadm_sudo_t:s0 tcontext=sysadm_u:sysadm_r:sysadm_t:s0 tclass=unix_stream_socket permissive=0
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
675144499f
Signal during logout
...
node=localhost type=AVC msg=audit(1701975071.847:229359): avc: denied { signal } for pid=10270 comm="cockpit-session" scontext=system_u:system_r:cockpit_session_t:s0 tcontext=sysadm_u:sysadm_r:sysadm_ssh_agent_t:s0 tclass=process permissive=0
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
a242691898
The L+ tmpfiles option needs to read the symlink
...
node=localhost type=AVC msg=audit(1701956913.910:21672): avc: denied {
read } for pid=3783 comm="systemd-tmpfile" name="motd" dev="tmpfs" ino=1812 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:cockpit_runtime_t:s0 tclass=lnk_file permissive=1
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
fddef574ba
Allow sudo dbus chat w/sysemd-logind
...
node=localhost type=USER_AVC msg=audit(1701890241.838:133264): pid=1613 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: denied { send_msg } for scontext=toor_u:staff_r:staff_sudo_t:s0 tcontext=system_u:system_r:systemd_logind_t:s0 tclass=dbus permissive=1 exe="/usr/bin/db us-broker" sauid=81 hostname=? addr=? terminal=?' UID="dbus" AUID="unset" SAUID="dbus"
node=localhost type=AVC msg=audit(1701890241.838:133265): avc: denied { search } for pid=1627 comm="systemd-logind" name="8995" dev="proc" ino=72855 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=toor_u:staff_r:staff_sudo_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1701890241.838:133265): avc: denied { read } for pid=1627 comm="systemd-logind" name="cgroup" dev="proc" ino=72856 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=toor_u:staff_r:staff_sudo_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1701890241.838:133265): avc: denied { open } for pid=1627 comm="systemd-logind" path="/proc/8995/cgroup" dev="proc" ino=72856 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=toor_u:staff_r:staff_sudo_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1701890241.838:133266): avc: denied { getattr } for pid=1627 comm="systemd-logind" path="/proc/8995/cgroup" dev="proc" ino=72856 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=toor_u:staff_r:staff_sudo_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1701890241.838:133267): avc: denied { ioctl } for pid=1627 comm="systemd-logind" path="/proc/8995/cgroup" dev="proc" ino=72856 ioctlcmd=0x5401 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=toor_u:staff_r:staff_sudo_t:s0 tclass=file permissive=1
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
c199c29b11
cockpit ssh as user
...
node=localhost type=AVC msg=audit(1701889205.276:117169): avc: denied { use } for pid=8720 comm="ssh-agent" path="pipe:[68232]" dev="pipefs" ino=68232 scontext=staff_u:sysadm_r:sysadm_ssh_agent_t:s0 tcontext=system_u:system_r:cockpit_session_t:s0 tclass=fd permissive=1
node=localhost type=AVC msg=audit(1701889205.276:117169): avc: denied { read } for pid=8720 comm="ssh-agent" path="pipe:[68232]" dev="pipefs" ino=68232 scontext=staff_u:sysadm_r:sysadm_ssh_agent_t:s0 tcontext=system_u:system_r:cockpit_session_t:s0 tclass=fifo_file permissive=1
node=localhost type=AVC msg=audit(1701889205.276:117169): avc: denied { write } for pid=8720 comm="ssh-agent" path="pipe:[68233]" dev="pipefs" ino=68233 scontext=staff_u:sysadm_r:sysadm_ssh_agent_t:s0 tcontext=system_u:system_r:cockpit_session_t:s0 tclass=fifo_file permissive=1
node=localhost type=AVC msg=audit(1701889205.314:117185): avc: denied { getattr } for pid=8720 comm="ssh-agent" path="pipe:[68233]" dev="pipefs" ino=68233 scontext=staff_u:sysadm_r:sysadm_ssh_agent_t:s0 tcontext=system_u:system_r:cockpit_session_t:s0 tclass=fifo_file permissive=1
node=localhost type=AVC msg=audit(1701889286.260:125552): avc: denied { use } for pid=8908 comm="ssh-agent" path="pipe:[70169]" dev="pipefs" ino=70169 scontext=staff_u:sysadm_r:sysadm_ssh_agent_t:s0 tcontext=system_u:system_r:cockpit_session_t:s0 tclass=fd permissive=0
node=localhost type=AVC msg=audit(1701889286.260:125552): avc: denied { use } for pid=8908 comm="ssh-agent" path="pipe:[70170]" dev="pipefs" ino=70170 scontext=staff_u:sysadm_r:sysadm_ssh_agent_t:s0 tcontext=system_u:system_r:cockpit_session_t:s0 tclass=fd permissive=0
node=localhost type=AVC msg=audit(1701889286.260:125552): avc: denied { use } for pid=8908 comm="ssh-agent" path="pipe:[70171]" dev="pipefs" ino=70171 scontext=staff_u:sysadm_r:sysadm_ssh_agent_t:s0 tcontext=system_u:system_r:cockpit_session_t:s0 tclass=fd permissive=0
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
4f90070e21
allow system --user to execute systemd-tmpfiles in <user>_systemd_tmpfiles_t domain
...
node=localhost type=AVC msg=audit(1701889206.398:119881): avc: denied { execute } for pid=8733 comm="(tmpfiles)" name="systemd-tmpfiles" dev="dm-1" ino=15564 scontext=staff_u:staff_r:staff_systemd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_tmpfiles_exec_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1701889206.398:119884): avc: denied { read open } for pid=8733 comm="(tmpfiles)" path="/usr/bin/systemd-tmpfiles" dev="dm-1" ino=15564 scontext=staff_u:staff_r:staff_systemd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_tmpfiles_exec_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1701889206.398:119884): avc: denied { execute_no_trans } for pid=8733 comm="(tmpfiles)" path="/usr/bin/systemd-tmpfiles" dev="dm-1" ino=15564 scontext=staff_u:staff_r:staff_systemd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_tmpfiles_exec_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1701889206.398:119884): avc: denied { map } for pid=8733 comm="systemd-tmpfile" path="/usr/bin/systemd-tmpfiles" dev="dm-1" ino=15564 scontext=staff_u:staff_r:staff_systemd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_tmpfiles_exec_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.473:3560): avc: denied { read write } for pid=4853 comm="systemd-tmpfile" path="socket:[47094]" dev="sockfs" ino=47094 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=sysadm_u:sysadm_r:sysadm_systemd_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1
node=localhost type=AVC msg=audit(1705259838.479:3562): avc: denied { search } for pid=4853 comm="systemd-tmpfile" name="kernel" dev="proc" ino=13283 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.479:3562): avc: denied { read } for pid=4853 comm="systemd-tmpfile" name="cap_last_cap" dev="proc" ino=13343 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.479:3562): avc: denied { open } for pid=4853 comm="systemd-tmpfile" path="/proc/sys/kernel/cap_last_cap" dev="proc" ino=13343 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.479:3563): avc: denied { getattr } for pid=4853 comm="systemd-tmpfile" name="/" dev="proc" ino=1 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3564): avc: denied { search } for pid=4853 comm="systemd-tmpfile" name="/" dev="tmpfs" ino=1 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3568): avc: denied { getattr } for pid=4853 comm="systemd-tmpfile" name="/" dev="cgroup2" ino=1 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cgroup_t:s0 tclass=filesystem permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3569): avc: denied { search } for pid=4853 comm="systemd-tmpfile" name="/" dev="cgroup2" ino=1 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3570): avc: denied { read } for pid=4853 comm="systemd-tmpfile" name="cmdline" dev="proc" ino=4026532018 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3570): avc: denied { open } for pid=4853 comm="systemd-tmpfile" path="/proc/cmdline" dev="proc" ino=4026532018 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3571): avc: denied { getattr } for pid=4853 comm="systemd-tmpfile" path="/proc/cmdline" dev="proc" ino=4026532018 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3572): avc: denied { ioctl } for pid=4853 comm="systemd-tmpfile" path="/proc/cmdline" dev="proc" ino=4026532018 ioctlcmd=0x5401 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3573): avc: denied { getattr } for pid=4853 comm="systemd-tmpfile" path="socket:[47094]" dev="sockfs" ino=47094 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=sysadm_u:sysadm_r:sysadm_systemd_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3574): avc: denied { create } for pid=4853 comm="systemd-tmpfile" scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3575): avc: denied { getopt } for pid=4853 comm="systemd-tmpfile" scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3576): avc: denied { setopt } for pid=4853 comm="systemd-tmpfile" scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3577): avc: denied { connect } for pid=4853 comm="systemd-tmpfile" scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3577): avc: denied { search } for pid=4853 comm="systemd-tmpfile" name="journal" dev="tmpfs" ino=55 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:syslogd_runtime_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3577): avc: denied { write } for pid=4853 comm="systemd-tmpfile" name="socket" dev="tmpfs" ino=57 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:devlog_t:s0 tclass=sock_file permissive=1
node=localhost type=AVC msg=audit(1705259838.522:3577): avc: denied { sendto } for pid=4853 comm="systemd-tmpfile" path="/run/systemd/journal/socket" scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_dgram_socket permissive=1
node=localhost type=AVC msg=audit(1705259838.523:3578): avc: denied { map } for pid=4853 comm="systemd-tmpfile" path="/sys/fs/selinux/status" dev="selinuxfs" ino=19 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.523:3579): avc: denied { search } for pid=4853 comm="systemd-tmpfile" name="contexts" dev="dm-1" ino=138857 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_context_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.523:3579): avc: denied { search } for pid=4853 comm="systemd-tmpfile" name="files" dev="dm-1" ino=138863 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_context_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.523:3579): avc: denied { read } for pid=4853 comm="systemd-tmpfile" name="file_contexts.subs_dist" dev="dm-1" ino=138865 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_context_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.523:3579): avc: denied { open } for pid=4853 comm="systemd-tmpfile" path="/etc/selinux/clip/contexts/files/file_contexts.subs_dist" dev="dm-1" ino=138865 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_context_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.523:3580): avc: denied { getattr } for pid=4853 comm="systemd-tmpfile" path="/etc/selinux/clip/contexts/files/file_contexts.subs_dist" dev="dm-1" ino=138865 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_context_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.523:3581): avc: denied { map } for pid=4853 comm="systemd-tmpfile" path="/etc/selinux/clip/contexts/files/file_contexts.bin" dev="dm-1" ino=131164 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_context_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.524:3582): avc: denied { getattr } for pid=4853 comm="systemd-tmpfile" path="/home" dev="dm-8" ino=2 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:home_root_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.524:3583): avc: denied { search } for pid=4853 comm="systemd-tmpfile" name="/" dev="dm-8" ino=2 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:home_root_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.524:3584): avc: denied { getattr } for pid=4853 comm="systemd-tmpfile" path="/home/sysadm" dev="dm-8" ino=26 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=sysadm_u:object_r:user_home_dir_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.524:3585): avc: denied { search } for pid=4853 comm="systemd-tmpfile" name="sysadm" dev="dm-8" ino=26 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=sysadm_u:object_r:user_home_dir_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.524:3586): avc: denied { getattr } for pid=4853 comm="systemd-tmpfile" path="/run" dev="tmpfs" ino=1 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.524:3587): avc: denied { getattr } for pid=4853 comm="systemd-tmpfile" path="/run/user" dev="tmpfs" ino=92 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_runtime_root_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.524:3588): avc: denied { search } for pid=4853 comm="systemd-tmpfile" name="user" dev="tmpfs" ino=92 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=system_u:object_r:user_runtime_root_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.524:3589): avc: denied { getattr } for pid=4853 comm="systemd-tmpfile" path="/run/user/1002" dev="tmpfs" ino=1 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=sysadm_u:object_r:user_runtime_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.524:3590): avc: denied { search } for pid=4853 comm="systemd-tmpfile" name="/" dev="tmpfs" ino=1 scontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tcontext=sysadm_u:object_r:user_runtime_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.526:3591): avc: denied { search } for pid=4845 comm="systemd" name="4853" dev="proc" ino=29607 scontext=sysadm_u:sysadm_r:sysadm_systemd_t:s0-s0:c0.c1023 tcontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1705259838.526:3591): avc: denied { read } for pid=4845 comm="systemd" name="comm" dev="proc" ino=47101 scontext=sysadm_u:sysadm_r:sysadm_systemd_t:s0-s0:c0.c1023 tcontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tclass=file permissive=1
node=localhost type=AVC msg=audit(1705259838.526:3591): avc: denied { open } for pid=4845 comm="systemd" path="/proc/4853/comm" dev="proc" ino=47101 scontext=sysadm_u:sysadm_r:sysadm_systemd_t:s0-s0:c0.c1023 tcontext=sysadm_u:sysadm_r:sysadm_systemd_tmpfiles_t:s0-s0:c0.c1023 tclass=file permissive=1
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
4bd6277912
Fix denial while cleaning up pidfile symlink
...
Nov 29 02:15:13 localhost.localdomain audisp-syslog[1698]: node=localhost type=AVC msg=audit(1701224113.540:7569): avc: denied { unlink } for pid=1 comm="systemd" name="key.source" dev="tmpfs" ino=1749 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:cockpit_runtime_t:s0 tclass=lnk_file permissive=1
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:28 -05:00
Dave Sugar
cc46c3296a
SELinux policy for cockpit
...
Setup domain for cockpit-certificate-ensure
Setup service rules
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2024-01-26 21:05:27 -05:00
