4845 Commits

Author	SHA1	Message	Date
Dave Sugar	3d55e918f6	Firewalld need to relabel direct.xml file ... firewalld[1084]: Traceback (most recent call last): File "/usr/lib/python3.9/site-packages/firewall/core/io/direct.py", line 372, in write shutil.copy2(self.filename, "%s.old" % self.filename) File "/usr/lib64/python3.9/shutil.py", line 445, in copy2 copystat(src, dst, follow_symlinks=follow_symlinks) File "/usr/lib64/python3.9/shutil.py", line 388, in copystat _copyxattr(src, dst, follow_symlinks=follow) File "/usr/lib64/python3.9/shutil.py", line 338, in _copyxattr os.setxattr(dst, name, value, follow_symlinks=follow_symlinks) PermissionError: [Errno 13] Permission denied: '/etc/firewalld/direct.xml.old' During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib/python3.9/site-packages/firewall/server/decorators.py", line 67, in _impl return func(*args, **kwargs) File "/usr/lib/python3.9/site-packages/firewall/server/config.py", line 1429, in update self.config.get_direct().write() File "/usr/lib/python3.9/site-packages/firewall/core/io/direct.py", line 374, in write raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) OSError: Backup of '/etc/firewalld/direct.xml' failed: [Errno 13] Permission denied: '/etc/firewalld/direct.xml.old' firewalld[1084]: ERROR: Backup of file '/etc/firewalld/zones/data.xml' failed: [Errno 13] Permission denied: '/etc/firewalld/zones/data.xml.old' node=localhost type=AVC msg=audit(1704599676.613:35145): avc: denied { relabelfrom } for pid=1084 comm="firewalld" name="data.xml.old" dev="dm-0" ino=1180472 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:firewalld_etc_rw_t:s0 tclass=file permissive=0 node=loalhost type=AVC msg=audit(1704599677.914:35287): avc: denied { relabelfrom } for pid=1084 comm="firewalld" name="direct.xml.old" dev="dm-0" ino=1180671 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:firewalld_etc_rw_t:s0 tclass=file permissive=0 node=localhost type=AVC msg=audit(1704599788.714:41689): avc: denied { relabelfrom } for pid=1084 comm="firewalld" name="data.xml.old" dev="dm-0" ino=1180472 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:firewalld_etc_rw_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1704599788.714:41689): avc: denied { relabelto } for pid=1084 comm="firewalld" name="data.xml.old" dev="dm-0" ino=1180472 scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:firewalld_etc_rw_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2024-01-07 17:15:36 -05:00
Christian Göttsche	82f7160a20	init: only grant getattr in init_getattr_generic_units_files() ... Like the name suggests only grant the permission getattr in init_getattr_generic_units_files(). Adjust the only caller to use init_read_generic_units_files() instead. Reported-by: Laurent Bigonville Signed-off-by: Christian Göttsche <cgzones@googlemail.com>	2024-01-04 20:43:20 +01:00
Kenton Groombridge	a0018e4e85	kubernetes: allow container engines to mount on DRI devices if enabled ... Signed-off-by: Kenton Groombridge <concord@gentoo.org>	2024-01-04 09:46:41 -05:00
Kenton Groombridge	16323cfce2	container, kubernetes: add support for cilium ... Cilium is a kubernetes CNI powered by BPF. Its daemon pods run as super privileged containers which require various accesses in order to load BPF programs and modify the host network. Signed-off-by: Kenton Groombridge <concord@gentoo.org>	2024-01-04 09:46:41 -05:00
Kenton Groombridge	d2f413c1b6	container: various fixes ... Signed-off-by: Kenton Groombridge <concord@gentoo.org>	2024-01-04 09:46:41 -05:00
Chris PeBenito	d4555fd002	Merge pull request #744 from quic-kmeng/main ... filesystem:Add type contexts and interface for functionfs	2024-01-04 09:39:39 -05:00
Kai Meng	76951aa43c	devices:Add genfscon context for functionfs to mount ... When start up adbd by adb initscript, there's a command like: mount -o uid=2000,gid=2000 -t functionfs adb /dev/usb-ffs/adb will cause below deny because lack of functionfs related contexts. avc: denied { mount } for pid=346 comm="mount" name="/" dev="functionfs" ino=17700 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 Signed-off-by: Kai Meng <quic_kmeng@quicinc.com>	2024-01-04 14:29:02 +08:00
Chris PeBenito	e7cdbe3f5b	Merge pull request #743 from dsugar100/dbus_fixes ... Dbus fixes	2024-01-03 10:56:24 -05:00
Chris PeBenito	14a6144733	Merge pull request #746 from yizhao1/cryptsetup ... fix some contexts	2024-01-03 10:55:40 -05:00
Yi Zhao	249263f7c4	container: set context for /run/crun ... /run/crun is the runtime directory for crun. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>	2024-01-03 19:18:41 +08:00
Yi Zhao	96cb5e6304	lvm: set context for /run/cryptsetup ... * Set context for /runcryptesetup created by systemd-cryptsetup. * Remove duplicate line 'fs_getattr_cgroup(lvm_t)'. Signed-off-by: Yi Zhao <yi.zhao@windriver.com>	2024-01-03 19:17:24 +08:00
Dave Sugar	58e4c9a36f	dbus changes ... dbus needs to map security_t files private type ($1_dbus_tmpfs_t) for file created on tmpfs Dec 20 18:18:15 localhost.localdomain dbus-broker-launch[1927]: avc: could not open selinux status page: 13 (Permission denied) Dec 20 18:18:15 localhost.localdomain dbus-broker-launch[1927]: ERROR bus_selinux_init_global @ ../src/util/selinux.c +336: Permission denied Dec 20 18:18:15 localhost.localdomain dbus-broker-launch[1927]: main @ ../src/broker/main.c +285 Dec 20 18:18:15 localhost.localdomain dbus-broker-launch[1927]: main @ ../src/broker/main.c +295 Dec 20 18:18:15 localhost.localdomain dbus-broker-launch[1926]: ERROR service_add @ ../src/launch/service.c +921: Transport endpoint is not connected Dec 20 18:18:15 localhost.localdomain dbus-broker-launch[1926]: launcher_add_services @ ../src/launch/launcher.c +804 Dec 20 18:18:15 localhost.localdomain dbus-broker-launch[1926]: launcher_run @ ../src/launch/launcher.c +1409 Dec 20 18:18:15 localhost.localdomain dbus-broker-launch[1926]: run @ ../src/launch/main.c +152 Dec 20 18:18:15 localhost.localdomain audisp-syslog[1585]: node=localhost type=AVC msg=audit(1703096295.282:5058): avc: denied { map } for pid=1927 comm="dbus-broker" path="/sys/fs/selinux/status" dev="selinuxfs" ino=19 scontext=toor_u:staff_r:staff_dbusd_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=file permissive=0 Dec 20 18:18:15 localhost.localdomain dbus-broker-launch[1926]: main @ ../src/launch/main.c +178 Dec 20 18:18:15 localhost.localdomain dbus-broker-launch[1926]: Exiting due to fatal error: -107 Dec 20 18:18:15 localhost.localdomain systemd[1824]: dbus-broker.service: Main process exited, code=exited, status=1/FAILURE Dec 20 18:18:15 localhost.localdomain systemd[1824]: dbus-broker.service: Failed with result 'exit-code'. node=localhost type=AVC msg=audit(1703095496.614:486): avc: denied { write } for pid=1838 comm="dbus-broker-lau" name="memfd:dbus-broker-log" dev="tmpfs" ino=1026 scontext=user_u:user_r:user_dbusd_t:s0 tcontext=user_u:object_r:tmpfs_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1703095496.614:487): avc: denied { map } for pid=1838 comm="dbus-broker-lau" path=2F6D656D66643A646275732D62726F6B65722D6C6F67202864656C6574656429 dev="tmpfs" ino=1026 scontext=user_u:user_r:user_dbusd_t:s0 tcontext=user_u:object_r:tmpfs_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1703095496.614:487): avc: denied { read } for pid=1838 comm="dbus-broker-lau" path=2F6D656D66643A646275732D62726F6B65722D6C6F67202864656C6574656429 dev="tmpfs" ino=1026 scontext=user_u:user_r:user_dbusd_t:s0 tcontext=user_u:object_r:tmpfs_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1703095554.440:7369): avc: denied { write } for pid=1839 comm="dbus-broker" name="memfd:dbus-broker-log" dev="tmpfs" ino=2057 scontext=user_u:user_r:user_dbusd_t:s0 tcontext=user_u:object_r:tmpfs_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1703095554.440:7370): avc: denied { map } for pid=1839 comm="dbus-broker" path=2F6D656D66643A646275732D62726F6B65722D6C6F67202864656C6574656429 dev="tmpfs" ino=2057 scontext=user_u:user_r:user_dbusd_t:s0 tcontext=user_u:object_r:tmpfs_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1703095554.440:7370): avc: denied { read } for pid=1839 comm="dbus-broker" path=2F6D656D66643A646275732D62726F6B65722D6C6F67202864656C6574656429 dev="tmpfs" ino=2057 scontext=user_u:user_r:user_dbusd_t:s0 tcontext=user_u:object_r:tmpfs_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1703096160.845:7632): avc: denied { write } for pid=2394 comm="dbus-broker-lau" name="memfd:dbus-broker-log" dev="tmpfs" ino=3077 scontext=toor_u:staff_r:staff_dbusd_t:s0 tcontext=toor_u:object_r:tmpfs_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1703096160.845:7633): avc: denied { map } for pid=2394 comm="dbus-broker-lau" path=2F6D656D66643A646275732D62726F6B65722D6C6F67202864656C6574656429 dev="tmpfs" ino=3077 scontext=toor_u:staff_r:staff_dbusd_t:s0 tcontext=toor_u:object_r:tmpfs_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1703096160.845:7633): avc: denied { read } for pid=2394 comm="dbus-broker-lau" path=2F6D656D66643A646275732D62726F6B65722D6C6F67202864656C6574656429 dev="tmpfs" ino=3077 scontext=toor_u:staff_r:staff_dbusd_t:s0 tcontext=toor_u:object_r:tmpfs_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2024-01-02 15:18:55 -05:00
Christian Göttsche	86d9a00e7f	git: add fcontext for default binary ... Avoid relabel loops if the helper binaries are hardlinked: $ restorecon -vRF -T0 /usr/libexec/ Relabeled /usr/libexec/git-core/git from system_u:object_r:git_exec_t to system_u:object_r:bin_t Relabeled /usr/libexec/git-core/git-rev-parse from system_u:object_r:bin_t to system_u:object_r:git_exec_t Relabeled /usr/libexec/git-core/git-fsmonitor--daemon from system_u:object_r:bin_t to system_u:object_r:git_exec_t Signed-off-by: Christian Göttsche <cgzones@googlemail.com>	2023-12-28 17:52:08 +01:00
Dave Sugar	2680abe1f8	Allow dbus-broker-launch to execute in same domain ... node=localhost type=AVC msg=audit(1703080976.876:873613): avc: denied { execute_no_trans } for pid=6840 comm="dbus-broker-lau" path="/usr/bin/dbus-broker" dev="dm-1" ino=16361 scontext=toor_u:staff_r:staff_dbusd_t:s0 tcontext=system_u:object_r:dbusd_exec_t:s0 tclass=file permissive=0 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-12-20 14:49:39 -05:00
Dave Sugar	dd21a7724a	Changes needed for dbus-broker-launch ... node=localhost type=AVC msg=audit(1701877079.240:52506): avc: denied { read } for pid=7055 comm="dbus-broker-lau" name="machine-id" dev="dm-1" ino=131423 scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1701877079.240:52506): avc: denied { open } for pid=7055 comm="dbus-broker-lau" path="/etc/machine-id" dev="dm-1" ino=131423 scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_runtime_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1701877079.244:52520): avc: denied { connectto } for pid=7054 comm="dbus-broker-lau" path="/run/user/1001/bus" scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1 node=localhost type=AVC msg=audit(1701877079.239:52504): avc: denied { sendto } for pid=7054 comm="dbus-broker-lau" path="/run/user/1001/systemd/notify" scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=staff_u:staff_r:staff_systemd_t:s0-s0:c0.c1023 tclass=unix_dgram_socket permissive=1 node=localhost type=AVC msg=audit(1701877079.239:52504): avc: denied { search } for pid=7054 comm="dbus-broker-lau" name="systemd" dev="tmpfs" ino=2 scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:systemd_user_runtime_t:s0 tclass=dir permissive=1 node=localhost type=AVC msg=audit(1701877079.239:52504): avc: denied { write } for pid=7054 comm="dbus-broker-lau" name="notify" dev="tmpfs" ino=13 scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:systemd_user_runtime_notify_t:s0 tclass=sock_file permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-12-20 14:48:54 -05:00
Kenton Groombridge	b1a8799185	sysadm: allow using networkctl ... Signed-off-by: Kenton Groombridge <concord@gentoo.org>	2023-12-17 23:42:07 -05:00
Kenton Groombridge	43d529e90e	glusterfs: add tunable to allow managing unlabeled files ... If gluster ever experiences data corruption on its underlying bricks, a situation may arise where the corrupted files have bad or missing xattrs and are therefore presented as unlabeled to SELinux. Gluster will then be unable to repair these files until the access is allowed or the user manually relabels these files. Signed-off-by: Kenton Groombridge <concord@gentoo.org>	2023-12-17 23:42:04 -05:00
Kenton Groombridge	c3dbaf035c	container: allow watching FUSEFS dirs and files ... Signed-off-by: Kenton Groombridge <concord@gentoo.org>	2023-12-17 23:10:02 -05:00
Guido Trentalancia	82b4448e1d	Additional file context fix for: ... https://github.com/SELinuxProject/refpolicy/issues/735 This patch extends the fix for a serious Information Disclosure vulnerability caused by the erroneous labeling of TLS Private Keys and CSR. See: commit 5c9038ec98 Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/system/miscfiles.fc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)	2023-12-05 21:04:29 +01:00
Chris PeBenito	044e318dd7	Merge pull request #738 from ffontaine/main ... policy/modules/services/smartmon.te: make fstools optional	2023-11-29 09:43:44 -05:00
Chris PeBenito	4b1ba3cc47	Merge pull request #736 from gtrentalancia/init_fixes_pr ... Restrict LDAP server init script permissions on generic certificate files	2023-11-29 09:39:43 -05:00
Fabrice Fontaine	65eed16b58	policy/modules/services/smartmon.te: make fstools optional ... Make fstools optional to avoid the following build failure raised since version 2.20231002 and cb068f09d2: Compiling targeted policy.33 env LD_LIBRARY_PATH="/home/thomas/autobuild/instance-2/output-1/host/lib:/home/thomas/autobuild/instance-2/output-1/host/usr/lib" /home/thomas/autobuild/instance-2/output-1/host/usr/bin/checkpolicy -c 33 -U deny -S -O -E policy.conf -o policy.33 policy/modules/services/smartmon.te:146:ERROR 'type fsadm_exec_t is not within scope' at token ';' on line 237472: allow smartmon_update_drivedb_t fsadm_exec_t:file { { getattr open map read execute ioctl } ioctl lock execute_no_trans }; #line 146 checkpolicy: error(s) encountered while parsing configuration make[1]: *** [Rules.monolithic:80: policy.33] Error 1 Fixes: - http://autobuild.buildroot.org/results/a01123de9a8c1927060e7e4748666bebfc82ea44 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>	2023-11-29 08:37:25 +01:00
Guido Trentalancia	2e27be3c56	Let the certmonger module manage SSL Private Keys ... and CSR used for example by the HTTP and/or Mail Transport daemons. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/certmonger.te | 3 +++ 1 file changed, 3 insertions(+)	2023-11-20 17:09:31 +01:00
Guido Trentalancia	912d3a687b	Let the webadm role manage Private Keys and CSR for ... SSL Certificates used by the HTTP daemon. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/roles/webadm.te | 4 ++++ 1 file changed, 4 insertions(+)	2023-11-20 17:09:12 +01:00
Guido Trentalancia	5c9038ec98	Create new TLS Private Keys file contexts for the ... Apache HTTP server according to the default locations: http://www.apache.com/how-to-setup-an-ssl-certificate-on-apache Add the correct TLS Private Keys file label for Debian systems. This patch fixes a serious Information Disclosure vulnerability caused by the erroneous labeling of TLS Private Keys and CSR, as explained above. See: https://github.com/SELinuxProject/refpolicy/issues/735 Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/system/miscfiles.fc | 3 +++ 1 file changed, 3 insertions(+)	2023-11-19 22:44:27 +01:00
Guido Trentalancia	b38583a79d	The LDAP server only needs to read generic certificate ... files, not manage them. Modify the init policy to match the comment and the LDAP server actual behavior. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/system/init.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)	2023-11-19 22:23:37 +01:00
Yi Zhao	100a853c0c	rpm: fixes for dnf ... * Set labels for /var/lib/dnf/. * Allow useradd/groupadd to read/append rpm temporary files. * Allow rpm_t to send/receive messages from systemd-logind over dbus. * Allow rpm_t to use inherited systemd-logind file descriptors. Fixes: avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.login1.Manager member=Inhibit dest=org.freedesktop.login1 spid=565 tpid=331 scontext=root:sysadm_r:rpm_t tcontext=system_u:system_r:systemd_logind_t tclass=dbus permissive=1 avc: denied { send_msg } for msgtype=method_return dest=:1.11 spid=331 tpid=565 scontext=system_u:system_r:systemd_logind_t tcontext=root:sysadm_r:rpm_t tclass=dbus permissive=1 avc: denied { use } for pid=565 comm="python3" path="/run/systemd/inhibit/1.ref" dev="tmpfs" ino=703 scontext=root:sysadm_r:rpm_t tcontext=system_u:system_r:systemd_logind_t tclass=fd permissive=1 avc: denied { read append } for pid=590 comm="groupadd" path="/tmp/tmpy6epkors" dev="tmpfs" ino=20 scontext=root:sysadm_r:groupadd_t tcontext=root:object_r:rpm_tmp_t tclass=file permissive=1 avc: denied { getattr } for pid=590 comm="groupadd" name="/" dev="proc" ino=1 scontext=root:sysadm_r:groupadd_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 avc: denied { ioctl } for pid=590 comm="groupadd" path="/tmp/tmpy6epkors" dev="tmpfs" ino=20 ioctlcmd=0x5401 scontext=root:sysadm_r:groupadd_t tcontext=root:object_r:rpm_tmp_t tclass=file permissive=1 avc: denied { read append } for pid=626 comm="useradd" path="/tmp/tmpy6epkors" dev="tmpfs" ino=20 scontext=root:sysadm_r:useradd_t tcontext=root:object_r:rpm_tmp_t tclass=file permissive=1 avc: denied { ioctl } for pid=626 comm="useradd" path="/tmp/tmpy6epkors" dev="tmpfs" ino=20 ioctlcmd=0x5401 scontext=root:sysadm_r:useradd_t tcontext=root:object_r:rpm_tmp_t tclass=file permissive=1 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>	2023-11-16 21:58:18 +08:00
Chris PeBenito	0b148c02b6	Merge pull request #730 from gtrentalancia/gpg_fixes2_pr ... Modify the gpg module so that gpg and the gpg_agent	2023-11-14 11:04:40 -05:00
Guido Trentalancia	8839a7137d	Modify the gpg module so that gpg and the gpg_agent ... can manage gpg_runtime_t socket files. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/apps/gpg.te | 2 ++ 1 file changed, 2 insertions(+)	2023-11-11 15:44:24 +01:00
Russell Coker	780adb80af	Simple patch for Brother printer drivers as described in: ... https://etbe.coker.com.au/2023/10/22/brother-mfc-j4440dw-printer/ Signed-off-by: Russell Coker <russell@coker.com.au>	2023-10-23 00:09:26 +11:00
Chris PeBenito	f3865abfc2	Merge pull request #717 from dsugar100/use_chat_machined_interface ... Use interface that already exists.	2023-10-09 09:35:59 -04:00
Chris PeBenito	f5eba7176e	Merge pull request #723 from etbe/modemmanager ... modemmanager and eg25manager changes needed for pinephonepro	2023-10-09 09:34:07 -04:00
Russell Coker	3e39efffdf	patches for nspawn policy (#721) ... * patches to nspawn policy. Allow it netlink operations and creating udp sockets Allow remounting and reading sysfs Allow stat cgroup filesystem Make it create fifos and sock_files in the right context Allow mounting the selinux fs Signed-off-by: Russell Coker <russell@coker.com.au> * Use the new mounton_dir_perms and mounton_file_perms macros Signed-off-by: Russell Coker <russell@coker.com.au> * Corrected macro name Signed-off-by: Russell Coker <russell@coker.com.au> * Fixed description of files_mounton_kernel_symbol_table Signed-off-by: Russell Coker <russell@coker.com.au> * systemd: Move lines in nspawn. No rule changes. Signed-off-by: Chris PeBenito <pebenito@ieee.org> --------- Signed-off-by: Russell Coker <russell@coker.com.au> Signed-off-by: Chris PeBenito <pebenito@ieee.org> Co-authored-by: Chris PeBenito <pebenito@ieee.org>	2023-10-09 09:32:38 -04:00
Yi Zhao	6eecf51716	systemd: use init_daemon_domain instead of init_system_domain for systemd-networkd and systemd-resolved ... Systemd-networkd and systemd-resolved are daemons. Fixes: avc: denied { write } for pid=277 comm="systemd-resolve" name="notify" dev="tmpfs" ino=31 scontext=system_u:system_r:systemd_resolved_t tcontext=system_u:object_r:systemd_runtime_notify_t tclass=sock_file permissive=1 avc: denied { write } for pid=324 comm="systemd-network" name="notify" dev="tmpfs" ino=31 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:systemd_runtime_notify_t tclass=sock_file permissive=1 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>	2023-10-07 14:41:16 +08:00
Russell Coker	9f7d6ff7a0	Changes to eg25manager and modemmanager needed for firmware upload on pinephonepro ... Signed-off-by: Russell Coker <russell@coker.com.au>	2023-10-07 13:56:52 +11:00
Chris PeBenito	d542d53698	Merge pull request #720 from etbe/raid ... small mdadm changes for cron job	2023-10-06 09:26:55 -04:00
Dave Sugar	0a9650901c	Separate label for /run/systemd/notify (#710) ... * Separate label for /run/systemd/notify label systemd_runtime_notify_t Allow daemon domains to write by default Signed-off-by: Dave Sugar <dsugar100@gmail.com> * systemd: Add -s to /run/systemd/notify socket. Signed-off-by: Chris PeBenito <pebenito@ieee.org> --------- Signed-off-by: Dave Sugar <dsugar100@gmail.com> Co-authored-by: Chris PeBenito <pebenito@ieee.org>	2023-10-06 09:06:39 -04:00
Russell Coker	c2a9111a5c	Label checkarray as mdadm_exec_t, allow it to read/write temp files inherited ... from cron, and dontaudit ps type operations from it Signed-off-by: Russell Coker <russell@coker.com.au>	2023-10-06 21:48:52 +11:00
Dave Sugar	12ad93d167	Use interface that already exists. ... Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-10-05 17:31:33 -04:00
Russell Coker	be2e8970e0	https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/ ... While cgroups2 doesn't have the "feature" of having the kernel run a program specified in the cgroup the history of this exploit suggests that writing to cgroups should be restricted and not granted to all users Signed-off-by: Russell Coker <russell@coker.com.au>	2023-10-05 22:13:54 +11:00
Chris PeBenito	44fd3ebd12	Merge pull request #715 from yizhao1/bind ... bind: fix for named service	2023-10-02 08:58:52 -04:00
Chris PeBenito	275e3f0ef9	Merge pull request #714 from yizhao1/systemd-journal-catalog-update ... systemd: allow journalctl to create /var/lib/systemd/catalog	2023-10-02 08:57:55 -04:00
Chris PeBenito	6909b4b2f9	Merge pull request #713 from gtrentalancia/openoffice_fixes_pr2 ... Let openoffice perform temporary file transitions on link files and manage them	2023-10-02 08:57:04 -04:00
Yi Zhao	0a776a270a	bind: fix for named service ... Fixes: avc: denied { sqpoll } for pid=373 comm="named" scontext=system_u:system_r:named_t:s0-s15:c0.c1023 tcontext=system_u:system_r:named_t:s0-s15:c0.c1023 tclass=io_uring permissive=0 avc: denied { create } for pid=373 comm="named" anonclass=[io_uring] scontext=system_u:system_r:named_t:s0-s15:c0.c1023 tcontext=system_u:object_r:named_t:s0 tclass=anon_inode permissive=0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>	2023-10-02 16:38:12 +08:00
Yi Zhao	4ce68f22d8	systemd: allow journalctl to create /var/lib/systemd/catalog ... If /var/lib/systemd/catalog doesn't exist at first boot, systemd-journal-catalog-update.service would fail: $ systemctl status systemd-journal-catalog-update.service systemd-journal-catalog-update.service - Rebuild Journal Catalog Loaded: loaded (/usr/lib/systemd/system/systemd-journal-catalog-update.service; static) Active: failed (Result: exit-code) since Sat 2023-09-30 09:46:46 UTC; 50s ago Docs: man:systemd-journald.service(8) man:journald.conf(5) Process: 247 ExecStart=journalctl --update-catalog (code=exited, status=1/FAILURE) Main PID: 247 (code=exited, status=1/FAILURE) Sep 30 09:46:45 qemux86-64 systemd[1]: Starting Rebuild Journal Catalog... Sep 30 09:46:46 qemux86-64 journalctl[247]: Failed to create parent directories of /var/lib/systemd/catalog/database: Permission denied Sep 30 09:46:46 qemux86-64 journalctl[247]: Failed to write /var/lib/systemd/catalog/database: Permission denied Sep 30 09:46:46 qemux86-64 journalctl[247]: Failed to list catalog: Permission denied Sep 30 09:46:46 qemux86-64 systemd[1]: systemd-journal-catalog-update.service: Main process exited, code=exited, status=1/FAILURE Sep 30 09:46:46 qemux86-64 systemd[1]: systemd-journal-catalog-update.service: Failed with result 'exit-code'. Sep 30 09:46:46 qemux86-64 systemd[1]: Failed to start Rebuild Journal Catalog. Fixes: AVC avc: denied { getattr } for pid=247 comm="journalctl" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:systemd_journal_init_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=0 AVC avc: denied { write } for pid=247 comm="journalctl" name="systemd" dev="vda" ino=13634 scontext=system_u:system_r:systemd_journal_init_t tcontext=system_u:object_r:init_var_lib_t tclass=dir permissive=0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>	2023-09-30 18:34:40 +08:00
Guido Trentalancia	701410e7a6	Let openoffice perform temporary file transitions ... and manage link files. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/apps/openoffice.te | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)	2023-09-29 22:30:14 +02:00
Russell Coker	1c0b2027f9	misc small email changes (#704) ... * Small changes to courier, dovecot, exim, postfix, amd sendmail policy. Signed-off-by: Russell Coker <russell@coker.com.au> * Removed an obsolete patch Signed-off-by: Russell Coker <russell@coker.com.au> * Added interfaces cron_rw_inherited_tmp_files and systemd_dontaudit_connect_machined Signed-off-by: Russell Coker <russell@coker.com.au> * Use create_stream_socket_perms for unix connection to itself Signed-off-by: Russell Coker <russell@coker.com.au> * Removed unconfined_run_to Signed-off-by: Russell Coker <russell@coker.com.au> * Remove change for it to run from a user session Signed-off-by: Russell Coker <russell@coker.com.au> * Changed userdom_use_user_ttys to userdom_use_inherited_user_terminals and moved it out of the postfix section Signed-off-by: Russell Coker <russell@coker.com.au> --------- Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-28 09:57:18 -04:00
Russell Coker	bb90d67768	mon.te patches as well as some fstools patches related to it (#697) ... * Patches for mon, mostly mon local monitoring. Also added the fsdaemon_read_lib() interface and fstools patch because it also uses fsdaemon_read_lib() and it's called by monitoring scripts Signed-off-by: Russell Coker <russell@coker.com.au> * Added the files_dontaudit_tmpfs_file_getattr() and storage_dev_filetrans_fixed_disk_control() interfaces needed Signed-off-by: Russell Coker <russell@coker.com.au> * Fixed the issues from the review Signed-off-by: Russell Coker <russell@coker.com.au> * Specify name to avoid conflicting file trans Signed-off-by: Russell Coker <russell@coker.com.au> * fixed dontaudi_ typo Signed-off-by: Russell Coker <russell@coker.com.au> * Changed storage_dev_filetrans_fixed_disk to have a mandatory parameter for the object class Signed-off-by: Russell Coker <russell@coker.com.au> * Remove fsdaemon_read_lib as it was already merged Signed-off-by: Russell Coker <russell@coker.com.au> --------- Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-28 09:55:56 -04:00
Russell Coker	c51554cbab	misc small patches for cron policy (#701) ... * Some misc small patches for cron policy Signed-off-by: Russell Coker <russell@coker.com.au> * added systemd_dontaudit_connect_machined interface Signed-off-by: Russell Coker <russell@coker.com.au> * Remove the line about connecting to tor Signed-off-by: Russell Coker <russell@coker.com.au> * remove the dontaudit for connecting to machined Signed-off-by: Russell Coker <russell@coker.com.au> * changed to distro_debian Signed-off-by: Russell Coker <russell@coker.com.au> * mta: Whitespace changes. Signed-off-by: Chris PeBenito <pebenito@ieee.org> * cron: Move lines. Signed-off-by: Chris PeBenito <pebenito@ieee.org> --------- Signed-off-by: Russell Coker <russell@coker.com.au> Signed-off-by: Chris PeBenito <pebenito@ieee.org> Co-authored-by: Chris PeBenito <pebenito@ieee.org>	2023-09-28 09:46:14 -04:00
Russell Coker	1577b2105a	small systemd patches (#708) ... * Some small systemd patches Signed-off-by: Russell Coker <russell@coker.com.au> * Fixed error where systemd.if had a reference to user_devpts_t Signed-off-by: Russell Coker <russell@coker.com.au> * removed the init_var_run_t:service stuff as there's already interfaces and a type for it Signed-off-by: Russell Coker <russell@coker.com.au> * corecmd_shell_entry_type doesn't seem to be needed Signed-off-by: Russell Coker <russell@coker.com.au> --------- Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-27 09:20:52 -04:00
Dave Sugar	f141dccc2a	separate domain for journalctl during init ... During system boot, when systemd-journal-catalog-update.service is started, it fails becuase initrc_t doesn't have access to write systemd_journal_t files/dirs. This change is to run journalctl in a different domain during system startup (systemd_journal_init_t) to allow the access necessary to run. × systemd-journal-catalog-update.service - Rebuild Journal Catalog Loaded: loaded (/usr/lib/systemd/system/systemd-journal-catalog-update.service; static) Active: failed (Result: exit-code) since Wed 2023-09-13 12:51:28 GMT; 10min ago Docs: man:systemd-journald.service(8) man:journald.conf(5) Process: 1626 ExecStart=journalctl --update-catalog (code=exited, status=1/FAILURE) Main PID: 1626 (code=exited, status=1/FAILURE) CPU: 102ms Sep 13 12:51:28 localhost systemd[1]: Starting Rebuild Journal Catalog... Sep 13 12:51:28 localhost journalctl[1626]: Failed to open database for writing: /var/lib/systemd/catalog/database: Permission denied Sep 13 12:51:28 localhost journalctl[1626]: Failed to write /var/lib/systemd/catalog/database: Permission denied Sep 13 12:51:28 localhost journalctl[1626]: Failed to list catalog: Permission denied Sep 13 12:51:28 localhost systemd[1]: systemd-journal-catalog-update.service: Main process exited, code=exited, status=1/FAILURE Sep 13 12:51:28 localhost systemd[1]: systemd-journal-catalog-update.service: Failed with result 'exit-code'. Sep 13 12:51:28 localhost systemd[1]: Failed to start Rebuild Journal Catalog. node=localhost type=AVC msg=audit(1692308998.328:136): avc: denied { write } for pid=1631 comm="journalctl" name="catalog" dev="dm-10" ino=131106 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=dir permissive=1 node=localhost type=AVC msg=audit(1692308998.328:136): avc: denied { add_name } for pid=1631 comm="journalctl" name=".#database6ZdcMU" scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=dir permissive=1 node=localhost type=AVC msg=audit(1692308998.328:136): avc: denied { create } for pid=1631 comm="journalctl" name=".#database6ZdcMU" scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1692308998.328:136): avc: denied { write } for pid=1631 comm="journalctl" path="/var/lib/systemd/catalog/.#database6ZdcMU" dev="dm-10" ino=131204 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1692308998.330:137): avc: denied { setattr } for pid=1631 comm="journalctl" name=".#database6ZdcMU" dev="dm-10" ino=131204 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1692308998.330:138): avc: denied { remove_name } for pid=1631 comm="journalctl" name=".#database6ZdcMU" dev="dm-10" ino=131204 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=dir permissive=1 node=localhost type=AVC msg=audit(1692308998.330:138): avc: denied { rename } for pid=1631 comm="journalctl" name=".#database6ZdcMU" dev="dm-10" ino=131204 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1692308998.330:138): avc: denied { unlink } for pid=1631 comm="journalctl" name="database" dev="dm-10" ino=131133 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:object_r:systemd_journal_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-26 12:47:37 -04:00
Chris PeBenito	3bf196f6a3	Merge pull request #702 from etbe/db ... small postgresql and mysql stuff	2023-09-26 09:59:31 -04:00
Russell Coker	bcc92a3038	allow jabbers to create sock file and allow matrixd to read sysfs (#705) ... * Allow jabberd_domain to create sockets in it's var/lib dir Allow matrixd_t to read sysfs Signed-off-by: Russell Coker <russell@coker.com.au> * Changed to manage_sock_file_perms to allow unlink Signed-off-by: Russell Coker <russell@coker.com.au> --------- Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-26 09:48:31 -04:00
Chris PeBenito	61fbf428fb	postgresql: Move lines ... Signed-off-by: Chris PeBenito <pebenito@ieee.org>	2023-09-26 09:43:40 -04:00
Chris PeBenito	1a9143efa3	Merge pull request #696 from yizhao1/fixes ... Fixes for mount and loadkeys	2023-09-26 09:40:19 -04:00
Russell Coker	f849e27df3	small storage changes (#706) ... * Changes to storage.fc, smartmon, samba and lvm Signed-off-by: Russell Coker <russell@coker.com.au> * Add the interfaces this patch needs Signed-off-by: Russell Coker <russell@coker.com.au> * use manage_sock_file_perms for sock_file Signed-off-by: Russell Coker <russell@coker.com.au> * Renamed files_watch_all_file_type_dir to files_watch_all_dirs Signed-off-by: Russell Coker <russell@coker.com.au> * Use read_files_pattern Signed-off-by: Russell Coker <russell@coker.com.au> --------- Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-25 11:46:04 -04:00
Russell Coker	478df0e446	small network patches (#707) ... * Small changes for netutils(ping), firewalld, ftp, inetd, networkmanager, openvpn ppp and rpc Signed-off-by: Russell Coker <russell@coker.com.au> * Fixed typo in interface name Signed-off-by: Russell Coker <russell@coker.com.au> * Add interface libs_watch_shared_libs_dir Signed-off-by: Russell Coker <russell@coker.com.au> * Added sysnet_watch_config_dir interface Signed-off-by: Russell Coker <russell@coker.com.au> * renamed libs_watch_shared_libs_dir to libs_watch_shared_libs_dirs Signed-off-by: Russell Coker <russell@coker.com.au> * rename sysnet_watch_config_dir to sysnet_watch_config_dirs Signed-off-by: Russell Coker <russell@coker.com.au> * Reverted a change as I can't remember why I did it. Signed-off-by: Russell Coker <russell@coker.com.au> --------- Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-25 11:44:52 -04:00
Russell Coker	0d77235ecc	small ntp and dns changes (#703) ... * Small changes for ntp, bind, avahi, and dnsmasq Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-25 11:01:12 -04:00
Chris PeBenito	748980def5	Merge pull request #694 from etbe/fifth ... some misc userdomain fixes	2023-09-25 10:57:27 -04:00
Russell Coker	cf1ba82cb9	Added tmpfs file type for postgresql ... Small mysql stuff including anon_inode Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-22 19:09:12 +10:00
Russell Coker	0528990a24	policy patches for anti-spam daemons (#698) ... * Patches for anti-spam related policy * Added a seperate tunable for execmem, can be enabled for people who need it which means Debian rspam users and some of the less common SpamAssassin configurations Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-21 12:01:24 -04:00
Chris PeBenito	487feedf8e	Merge pull request #699 from yizhao1/systemd-networkd ... systemd: allow systemd-networkd to create file in /run/systemd directory	2023-09-21 10:45:47 -04:00
Russell Coker	125e52ef58	policy for the Reliability Availability servicability daemon (#690) ... * policy for the Reliability Availability servicability daemon Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-21 10:22:36 -04:00
Russell Coker	e349de1507	debian motd.d directory (#689) ... * policy for Debian motd.d dir Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-21 10:21:25 -04:00
Yi Zhao	8758b782e5	systemd: allow systemd-networkd to create file in /run/systemd directory ... systemd-networkd creates files in /run/systemd directory which should be labeled appropriately. Fixes: avc: denied { create } for pid=136 comm="systemd-network" name=".#networkd2c6a2ac2dbf34a8" scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:init_runtime_t tclass=file permissive=1 avc: denied { write } for pid=136 comm="systemd-network" path="/run/systemd/.#networkd2c6a2ac2dbf34a8" dev="tmpfs" ino=81 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:init_runtime_t tclass=file permissive=1 avc: denied { setattr } for pid=136 comm="systemd-network" name=".#networkd2c6a2ac2dbf34a8" dev="tmpfs" ino=81 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:init_runtime_t tclass=file permissive=1 avc: denied { rename } for pid=136 comm="systemd-network" name=".#networkd2c6a2ac2dbf34a8" dev="tmpfs" ino=81 scontext=system_u:system_r:systemd_networkd_t tcontext=system_u:object_r:init_runtime_t tclass=file permissive=1 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>	2023-09-21 11:40:24 +08:00
Yi Zhao	ee3ea8ebca	loadkeys: do not audit attempts to get attributes for all directories ... Fixes: avc: denied { getattr } for pid=239 comm="loadkeys" path="/boot" dev="vda" ino=15 scontext=system_u:system_r:loadkeys_t:s0-s15:c0.c1023 tcontext=system_u:object_r:boot_t:s0 tclass=dir permissive=1 avc: denied { getattr } for pid=239 comm="loadkeys" path="/home" dev="vda" ino=806 scontext=system_u:system_r:loadkeys_t:s0-s15:c0.c1023 tcontext=system_u:object_r:home_root_t:s0-s15:c0.c1023 tclass=dir permissive=1 avc: denied { getattr } for pid=239 comm="loadkeys" path="/lost+found" dev="vda" ino=11 scontext=system_u:system_r:loadkeys_t:s0-s15:c0.c1023 tcontext=system_u:object_r:lost_found_t:s15:c0.c1023 tclass=dir permissive=1 avc: denied { getattr } for pid=239 comm="loadkeys" path="/media" dev="vda" ino=810 scontext=system_u:system_r:loadkeys_t:s0-s15:c0.c1023 tcontext=system_u:object_r:mnt_t:s0 tclass=dir permissive=1 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>	2023-09-20 14:44:45 +08:00
Yi Zhao	0a7f48cb31	mount: allow mount_t to get attributes for all directories ... Fixes: avc: denied { getattr } for pid=130 comm="mount" path="/" dev="tracefs" ino=1 scontext=system_u:system_r:mount_t:s0-s15:c0.c1023 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=1 avc: denied { getattr } for pid=166 comm="mount" path="/" dev="configfs" ino=14220 scontext=system_u:system_r:mount_t:s0-s15:c0.c1023 tcontext=system_u:object_r:configfs_t:s0 tclass=dir permissive=1 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>	2023-09-20 13:31:50 +08:00
Russell Coker	cb6bf2fe9a	some misc userdomain fixes ... Allow userdomains to read crypto sysctls (usually /proc/sys/crypto/fips_enabled) Alow them to read vm overcommit status and fs_systls (things like pipe-max-size) Allow pipewire to write to user runtime named sockets Allow the user domain for X access to use user fonts, accept stream connections from xdm_t, and map xkb_var_lib_t files Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-20 12:40:59 +10:00
Chris PeBenito	227786eed7	Merge pull request #693 from dsugar100/colord ... Resolve some denials with colord	2023-09-19 16:09:52 -04:00
Chris PeBenito	fc3589a04f	Merge pull request #676 from dsugar100/all_users_syslog ... Allow all users to send syslog messages	2023-09-19 16:07:10 -04:00
Dave Sugar	17c9b3ac7e	Resolve some denials with colord ... Sep 13 19:20:51 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632851.771:656): avc: denied { read } for pid=2039 comm="colord" name="hwdb.bin" dev="dm-1" ino=393952 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:systemd_hwdb_t:s0 tclass=file permissive=1 Sep 13 19:20:51 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632851.771:656): avc: denied { open } for pid=2039 comm="colord" path="/etc/udev/hwdb.bin" dev="dm-1" ino=393952 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:systemd_hwdb_t:s0 tclass=file permissive=1 Sep 13 19:20:51 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632851.771:657): avc: denied { getattr } for pid=2039 comm="colord" path="/etc/udev/hwdb.bin" dev="dm-1" ino=393952 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:systemd_hwdb_t:s0 tclass=file permissive=1 Sep 13 19:20:51 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632851.771:658): avc: denied { map } for pid=2039 comm="colord" path="/etc/udev/hwdb.bin" dev="dm-1" ino=393952 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:systemd_hwdb_t:s0 tclass=file permissive=1 Sep 13 19:21:39 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632899.106:18931): avc: denied { read } for pid=2039 comm="gdbus" path="/home/toor/.local/share/icc/edid-bb6ad72dc802b000932c73ad20996ae5.icc" dev="dm-9" ino=129692 scontext=system_u:system_r:colord_t:s0 tcontext=toor_u:object_r:xdg_data_t:s0 tclass=file permissive=1 Sep 13 19:21:39 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632899.362:19182): avc: denied { getattr } for pid=2039 comm="colord" path="/home/toor/.local/share/icc/edid-bb6ad72dc802b000932c73ad20996ae5.icc" dev="dm-9" ino=129692 scontext=system_u:system_r:colord_t:s0 tcontext=toor_u:object_r:xdg_data_t:s0 tclass=file permissive=1 Sep 13 19:21:39 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632899.362:19183): avc: denied { map } for pid=2039 comm="colord" path="/home/toor/.local/share/icc/edid-bb6ad72dc802b000932c73ad20996ae5.icc" dev="dm-9" ino=129692 scontext=system_u:system_r:colord_t:s0 tcontext=toor_u:object_r:xdg_data_t:s0 tclass=file permissive=1 Sep 13 19:20:55 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632855.046:678): avc: denied { search } for pid=2039 comm="colord" name="1880" dev="proc" ino=26735 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:system_r:xdm_t:s0 tclass=dir permissive=1 Sep 13 19:20:55 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632855.046:678): avc: denied { read } for pid=2039 comm="colord" name="cgroup" dev="proc" ino=25503 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:system_r:xdm_t:s0 tclass=file permissive=1 Sep 13 19:20:55 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632855.046:678): avc: denied { open } for pid=2039 comm="colord" path="/proc/1880/cgroup" dev="proc" ino=25503 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:system_r:xdm_t:s0 tclass=file permissive=1 Sep 13 19:20:55 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632855.046:679): avc: denied { getattr } for pid=2039 comm="colord" path="/proc/1880/cgroup" dev="proc" ino=25503 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:system_r:xdm_t:s0 tclass=file permissive=1 Sep 13 19:20:55 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632855.046:680): avc: denied { ioctl } for pid=2039 comm="colord" path="/proc/1880/cgroup" dev="proc" ino=25503 ioctlcmd=0x5401 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:system_r:xdm_t:s0 tclass=file permissive=1 Sep 13 19:20:55 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632855.047:681): avc: denied { search } for pid=2039 comm="colord" name="sessions" dev="tmpfs" ino=96 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:systemd_sessions_runtime_t:s0 tclass=dir permissive=1 Sep 13 19:20:55 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632855.047:681): avc: denied { read } for pid=2039 comm="colord" name="c1" dev="tmpfs" ino=1692 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:systemd_sessions_runtime_t:s0 tclass=file permissive=1 Sep 13 19:20:55 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632855.047:681): avc: denied { open } for pid=2039 comm="colord" path="/run/systemd/sessions/c1" dev="tmpfs" ino=1692 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:systemd_sessions_runtime_t:s0 tclass=file permissive=1 Sep 13 19:20:55 localhost.localdomain audisp-syslog[1531]: node=localhost type=AVC msg=audit(1694632855.047:682): avc: denied { getattr } for pid=2039 comm="colord" path="/run/systemd/sessions/c1" dev="tmpfs" ino=1692 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:systemd_sessions_runtime_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-19 13:52:50 -04:00
Chris PeBenito	41ac8090f7	Merge pull request #691 from etbe/fifth ... power profiles daemon	2023-09-19 11:40:39 -04:00
Dave Sugar	cf58a70881	Allow all users to (optionally) send syslog messages ... Aug 29 12:53:06 localhost.localdomain audisp-syslog[1550]: node=localhost type=AVC msg=audit(1693313586.678:437): avc: denied { write } for pid=1757 comm="systemctl" name="socket" dev="tmpfs" ino=58 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:devlog_t:s0 tclass=sock_file permissive=1 Aug 29 12:53:06 localhost.localdomain audisp-syslog[1550]: node=localhost type=AVC msg=audit(1693313586.678:437): avc: denied { sendto } for pid=1757 comm="systemctl" path="/run/systemd/journal/socket" scontext=user_u:user_r:user_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_dgram_socket permissive=1 Aug 29 13:10:01 localhost.localdomain audisp-syslog[1545]: node=localhost type=AVC msg=audit(1693314601.860:435): avc: denied { write } for pid=1756 comm="systemctl" name="socket" dev="tmpfs" ino=58 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:devlog_t:s0 tclass=sock_file permissive=1 Aug 29 13:10:01 localhost.localdomain audisp-syslog[1545]: node=localhost type=AVC msg=audit(1693314601.860:435): avc: denied { sendto } for pid=1756 comm="systemctl" path="/run/systemd/journal/socket" scontext=user_u:user_r:user_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=unix_dgram_socket permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-19 09:14:08 -04:00
Russell Coker	e5ea2c99df	policy for power profiles daemon, used to change power settings ... Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-19 22:51:22 +10:00
Chris PeBenito	5e2bf62c6f	Merge pull request #672 from gtrentalancia/x_fixes_pr2 ... Remote X11 TCP/IP functionality is generally insecure: switch it off by default. Strengthen XDM authentication file access.	2023-09-19 08:36:26 -04:00
Guido Trentalancia	44bfd66186	Merge branch 'main' into x_fixes_pr2 ... Signed-off-by: Guido Trentalancia <guido@trentalancia.com>	2023-09-19 01:31:50 +02:00
Guido Trentalancia	8c562af119	The X display manager uses an authentication ... mechanism based on an authorization file which is critical for X security. For example, a common attack is to remove the file in order to disable authorization. At the moment permissions on such file and its parent directory are shared with several other modules that have nothing to do with XDMCP authorization, therefore this patch strenghtens the file access policy by making it exclusive to XDM and the X server (read-only). Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/xserver.fc | 1 + policy/modules/services/xserver.if | 33 +++++++++++++++++++++++++++++++++ policy/modules/services/xserver.te | 11 +++++++++++ 3 files changed, 45 insertions(+)	2023-09-19 01:28:10 +02:00
Guido Trentalancia	793d6a29d8	Introduce two new booleans for the X server and ... X display manager domains which control whether or not the respective domains allow the TCP/IP server networking functionality. The above mentioned booleans both default to false as remote X11 has no integrity and confidentiality protection and is generally insecure. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/xserver.te | 82 +++++++++++++++++++++++-------------- 1 file changed, 52 insertions(+), 30 deletions(-)	2023-09-19 01:23:22 +02:00
Chris PeBenito	d806720c76	unconfined: Keys are linkable by systemd. ... Since the systemd --user for unconfined_t runs in unconfined_t too, instead of a derived domain such as with regular users, e.g., user_systemd_t, this is required. Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>	2023-09-18 17:05:23 -04:00
Chris PeBenito	6e39f49247	Merge pull request #671 from gtrentalancia/dbus_fixes_pr3 ... Dbus also creates Unix domain sockets in session mode but has insecure networking code	2023-09-18 11:40:16 -04:00
Chris PeBenito	1ff9b559b7	Merge pull request #636 from gtrentalancia/spamassassin_update_pr ... Let spamassassin update its rules from the network	2023-09-18 11:38:57 -04:00
Guido Trentalancia	8331d214ec	Introduce a new "dbus_can_network" boolean which ... controls whether or not the dbus daemon can act as a server over TCP/IP networks and defaults to false, as this is generally insecure, except when using the local loopback interface. For reference, see the security warning in the D-Bus specification: https://dbus.freedesktop.org/doc/dbus-specification.html#transports-tcp-sockets Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/dbus.te | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-)	2023-09-18 16:15:50 +02:00
Chris PeBenito	69544a3256	Merge pull request #684 from etbe/fourth ... switcheroo daemon for switching apps between Intel and NVidia GPUs	2023-09-18 09:51:25 -04:00
Guido Trentalancia	11d17b2e57	Under request from Christopher PeBenito, merge the ... two spamassassin rules updating SELinux domains introduced in the previous change in order to reduce the non-swappable kernel memory used by the policy. This reduces complexity, but unfortunately it probably also reduces an existing safety margin by breaking the isolation between network-facing binaries and binaries such as GPG that potentially deal with secret information (at the moment there is no "neverallow" rule protecting the gpg_secret_t file access). Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/spamassassin.if | 3 - policy/modules/services/spamassassin.te | 56 ++++++-------------------------- 2 files changed, 12 insertions(+), 47 deletions(-)	2023-09-18 15:40:11 +02:00
Guido Trentalancia	e5b1b197c7	Update the spamassassin module in order to better support ... the rules updating script; this achieved by employing two distinct domains for increased security and network isolation: a first domain is used for fetching the updated rules from the network and second domain is used for verifying the GPG signatures of the received rules. The rules update feature is now controlled by a boolean for increased flexibility (it overrides the generic networking boolean). The specific file type for the spamassassin update feature temporary files has been removed: just use spamd_tmp_t instead of spamd_update_tmp_t and add a corresponding alias. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/spamassassin.if | 11 ++- policy/modules/services/spamassassin.te | 100 +++++++++++++++++++++++++------- 2 files changed, 86 insertions(+), 25 deletions(-)	2023-09-18 15:39:12 +02:00
Guido Trentalancia	ed0613f0cc	Extend the scope of the "spamassassin_can_network" ... tunable policy boolean to all network access (except the relative dontaudit rules). Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/spamassassin.te | 81 +++++++++++++++++--------------- 1 file changed, 45 insertions(+), 36 deletions(-)	2023-09-18 15:38:08 +02:00
Chris PeBenito	f4688a3d54	switcheroo: Whitespace fix. ... Signed-off-by: Chris PeBenito <pebenito@ieee.org>	2023-09-18 09:21:26 -04:00
Chris PeBenito	dfd0149c71	Merge pull request #674 from dsugar100/opasswd_label ... separate label for /etc/security/opasswd	2023-09-18 09:12:24 -04:00
Chris PeBenito	16c46db2b8	Merge pull request #665 from gtrentalancia/init_fixes_pr ... init and shutdown fixes	2023-09-18 09:08:32 -04:00
Chris PeBenito	d5a8f78328	Merge pull request #659 from dsugar100/luks_shutdown ... resolve lvm_t issues at shutdown with LUKS encrypted devices	2023-09-18 09:05:58 -04:00
Chris PeBenito	d6e6ce4f6a	Merge pull request #649 from gtrentalancia/gpg_fixes_pr ... Update the gpg module so that the application is able to fetch keys from the network	2023-09-18 09:05:14 -04:00
Dave Sugar	73a62c4404	resolve lvm_t issues at shutdown with LUKS encrypted devices ... Errors: Sep 06 15:27:15 localhost systemd-cryptsetup[1611]: Device luks-7e802906-791a-432d-8069-dd290fba6dcf is still in use. Sep 06 15:27:15 localhost systemd-cryptsetup[1611]: Failed to deactivate: Device or resource busy Sep 06 15:27:15 localhost systemd[1]: systemd-cryptsetup@luks\x2d7e802906\x2d791a\x2d432d\x2d8069\x2ddd290fba6dcf.service: Control process exited, code=exited, status=1/FAILURE Sep 06 15:27:15 localhost systemd[1]: systemd-cryptsetup@luks\x2d7e802906\x2d791a\x2d432d\x2d8069\x2ddd290fba6dcf.service: Failed with result 'exit-code'. Denials: Sep 06 15:25:19 localhost.localdomain audisp-syslog[1522]: node=localhost type=AVC msg=audit(1694013919.081:10597): avc: denied { getattr } for pid=1996 comm="systemd-cryptse" name="/" dev="cgroup2" ino=1 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=filesystem permissive=1 Sep 06 15:25:19 localhost.localdomain audisp-syslog[1522]: node=localhost type=SYSCALL msg=audit(1694013919.081:10597): arch=c000003e syscall=137 success=yes exit=0 a0=7efdc7a96e0e a1=7ffdbbacde50 a2=7efdc69b75e0 a3=1000 items=1 ppid=1 pid=1996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-cryptse" exe="/usr/lib/systemd/systemd-cryptsetup" subj=system_u:system_r:lvm_t:s0 key=(null) ARCH=x86_64 SYSCALL=statfs AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" Sep 06 15:25:19 localhost.localdomain audisp-syslog[1522]: node=localhost type=AVC msg=audit(1694013919.082:10598): avc: denied { search } for pid=1996 comm="systemd-cryptse" name="/" dev="cgroup2" ino=1 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir permissive=1 Sep 06 15:25:19 localhost.localdomain audisp-syslog[1522]: node=localhost type=AVC msg=audit(1694013919.085:10599): avc: denied { search } for pid=1996 comm="systemd-cryptse" name="pki" dev="dm-1" ino=393276 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=dir permissive=1 Sep 06 15:25:19 localhost.localdomain audisp-syslog[1522]: node=localhost type=AVC msg=audit(1694013919.085:10599): avc: denied { read } for pid=1996 comm="systemd-cryptse" name="openssl.cnf" dev="dm-1" ino=393383 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=file permissive=1 Sep 06 15:25:19 localhost.localdomain audisp-syslog[1522]: node=localhost type=AVC msg=audit(1694013919.085:10599): avc: denied { open } for pid=1996 comm="systemd-cryptse" path="/etc/pki/tls/openssl.cnf" dev="dm-1" ino=393383 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=file permissive=1 Sep 06 15:25:19 localhost.localdomain audisp-syslog[1522]: node=localhost type=SYSCALL msg=audit(1694013919.085:10599): arch=c000003e syscall=257 success=yes exit=7 a0=ffffff9c a1=55943c6cdb90 a2=0 a3=0 items=1 ppid=1 pid=1996 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-cryptse" exe="/usr/lib/systemd/systemd-cryptsetup" subj=system_u:system_r:lvm_t:s0 key=(null) ARCH=x86_64 SYSCALL=openat AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root" Sep 06 15:25:19 localhost.localdomain audisp-syslog[1522]: node=localhost type=AVC msg=audit(1694013919.086:10600): avc: denied { getattr } for pid=1996 comm="systemd-cryptse" path="/etc/pki/tls/openssl.cnf" dev="dm-1" ino=393383 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=file permissive=1 Sep 06 15:25:19 localhost.localdomain audisp-syslog[1522]: node=localhost type=AVC msg=audit(1694013919.087:10601): avc: denied { read } for pid=1996 comm="systemd-cryptse" name="fips_local.cnf" dev="dm-1" ino=393381 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:cert_t:s0 tclass=lnk_file permissive=1 Sep 06 15:27:15 localhost audisp-syslog[1497]: node=localhost type=AVC msg=audit(1694014035.204:367): avc: denied { search } for pid=1611 comm="systemd-cryptse" name="/" dev="pstore" ino=2357 scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:pstore_t:s0 tclass=dir permissive=0 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-15 15:34:54 -04:00
Guido Trentalancia	f3b359ec3f	Add new gpg interfaces for gpg_agent execution and to avoid ... auditing search operations on files and directories that are not strictly needed and might pose a security risk. The new interfaces will be used in a forthcoming update to allow fetching updates from the network for the spamassassin rules and the fsdaemon drive database. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/apps/gpg.if | 80 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+)	2023-09-14 18:38:17 +02:00
Chris PeBenito	ba922253f4	Merge pull request #679 from gtrentalancia/audit_fixes_pr ... Improve a previous syslog tunable policy change	2023-09-14 10:49:38 -04:00
Chris PeBenito	32be26840d	Merge pull request #673 from dsugar100/x_login ... Solve issue with no keyboard/mouse on X login screen	2023-09-14 10:38:25 -04:00
Russell Coker	c29ca4f257	switcheroo is a daemon to manage discrete vs integrated GPU use for apps ... Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-14 23:41:57 +10:00
Chris PeBenito	966cfad4fe	Merge pull request #678 from dsugar100/systemd_hostname ... For systemd-hostnamed service to run	2023-09-14 09:30:19 -04:00
Chris PeBenito	84e6a92d3b	Merge pull request #644 from dsugar100/rsyslog_caps ... Allow rsyslog to drop capabilities	2023-09-14 09:28:43 -04:00
Chris PeBenito	472603982f	Merge pull request #681 from dsugar100/fix_sddm_label ... /var/lib/sddm should be xdm_var_lib_t	2023-09-14 09:23:07 -04:00
Chris PeBenito	224476715e	Merge pull request #675 from dsugar100/ssh_session_error ... Fix some ssh agent denials	2023-09-14 09:16:32 -04:00
Russell Coker	7cb75c56c7	Daemon to monitor memory pressure and notify applications and change … (#670) ... * Daemon to monitor memory pressure and notify applications and change kernel OOM settings. Signed-off-by: Russell Coker <russell@coker.com.au> * Changed the self dgram access to create_socket_perms Signed-off-by: Russell Coker <russell@coker.com.au> --------- Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-14 09:15:09 -04:00
Chris PeBenito	7037ef3248	Merge pull request #638 from gtrentalancia/gnome_fixes_pr ... The gconf daemon (gnome module) must be able to create Unix domain sockets and use them as a server	2023-09-14 09:12:08 -04:00
Dave Sugar	cdd7c8cd5a	/var/lib/sddm should be xdm_var_lib_t ... based on denials, the fact that sddm runs as xdm_t and how other directories are labeled, xdm_var_lib_t seems more correct here. Sep 13 14:57:10 localhost.localdomain audisp-syslog[1570]: node=localhost type=AVC msg=audit(1694617030.144:419): avc: denied { search } for pid=1702 comm="sddm" name="sddm" dev="dm-10" ino=393297 scontext=system_u:system_r:xdm_t:s0 tcontext=system_u:object_r:xkb_var_lib_t:s0 tclass=dir permissive=0 Sep 13 14:59:31 localhost.localdomain audisp-syslog[1571]: node=localhost type=AVC msg=audit(1694617171.431:477): avc: denied { add_name } for pid=1768 comm="QQmlThread" name=".cache" scontext=system_u:system_r:xdm_t:s0 tcontext=system_u:object_r:xkb_var_lib_t:s0 tclass=dir permissive=1 Sep 13 14:59:31 localhost.localdomain audisp-syslog[1571]: node=localhost type=AVC msg=audit(1694617171.431:477): avc: denied { create } for pid=1768 comm="QQmlThread" name=".cache" scontext=system_u:system_r:xdm_t:s0 tcontext=system_u:object_r:xkb_var_lib_t:s0 tclass=dir permissive=1 Sep 13 14:59:31 localhost.localdomain audisp-syslog[1571]: node=localhost type=AVC msg=audit(1694617171.470:478): avc: denied { getattr } for pid=1768 comm="QQmlThread" path="/var/lib/sddm/.cache/sddm-greeter/qmlcache" dev="dm-10" ino=393280 scontext=system_u:system_r:xdm_t:s0 tcontext=system_u:object_r:xkb_var_lib_t:s0 tclass=dir permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-13 13:31:41 -04:00
Dave Sugar	131d4fcaca	Allow rsyslog to drop capabilities ... Aug 28 19:01:43 localhost.localdomain audisp-syslog[1565]: node=localhost type=AVC msg=audit(1693249303.693:415): avc: denied { setpcap } for pid=1722 comm="rsyslogd" capability=8 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:system_r:syslogd_t:s0 tclass=capability permissive=0 Aug 28 19:01:43 localhost.localdomain rsyslogd[1722]: libcap-ng used by "/usr/sbin/rsyslogd" failed dropping bounding set in capng_apply Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-13 11:53:25 -04:00
Guido Trentalancia	4d2ae53c17	Introduce a new interface in the mta module to manage the mail ... transport agent configuration directories and files. This interface will be used by a forthcoming update of the rule updating feature of the spamassassin module. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/mta.if | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)	2023-09-13 15:59:50 +02:00
Guido Trentalancia	37f81bbc80	Fix the recently introduced "logging_syslog_can_network" ... tunable policy, by including TCP/IP socket creation permissions. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/system/logging.te | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)	2023-09-13 15:34:09 +02:00
Dave Sugar	08866e6253	For systemd-hostnamed service to run ... systemd_hostnamed allowed to read/update/delete /run/systemd/default-hostname ○ systemd-hostnamed.service - Hostname Service Loaded: loaded (/usr/lib/systemd/system/systemd-hostnamed.service; static) Drop-In: /usr/lib/systemd/system/systemd-hostnamed.service.d └─disable-privatedevices.conf Active: inactive (dead) Docs: man:systemd-hostnamed.service(8) man:hostname(5) man:machine-info(5) man:org.freedesktop.resolve1(5) Sep 13 12:51:32 localhost systemd[1]: Starting Hostname Service... Sep 13 12:51:32 localhost systemd[1]: Started Hostname Service. Sep 13 12:51:32 localhost systemd-hostnamed[1777]: Failed to read /run/systemd/default-hostname, ignoring: Permission denied Sep 13 12:51:32 localhost.localdomain systemd-hostnamed[1777]: Hostname set to <localhost.localdomain> (transient) Sep 13 12:51:32 localhost.localdomain systemd-hostnamed[1777]: Failed to remove "/run/systemd/default-hostname": Permission denied Sep 13 12:52:02 localhost.localdomain systemd[1]: systemd-hostnamed.service: Deactivated successfully. Sep 13 12:54:09 localhost.localdomain systemd[1]: Starting Hostname Service... Sep 13 12:54:09 localhost.localdomain systemd[1]: Started Hostname Service. Sep 13 12:54:09 localhost.localdomain systemd-hostnamed[1931]: Failed to read /run/systemd/default-hostname, ignoring: Permission denied Sep 13 12:54:39 localhost.localdomain systemd[1]: systemd-hostnamed.service: Deactivated successfully. node=localhost type=AVC msg=audit(1689891544.345:413): avc: denied { read } for pid=22094 comm="systemd-hostnam" name="default-hostname" dev="tmpfs" ino=12 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1689891544.345:413): avc: denied { open } for pid=22094 comm="systemd-hostnam" path="/run/systemd/default-hostname" dev="tmpfs" ino=12 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1689891544.345:414): avc: denied { getattr } for pid=22094 comm="systemd-hostnam" path="/run/systemd/default-hostname" dev="tmpfs" ino=12 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1689891544.345:415): avc: denied { ioctl } for pid=22094 comm="systemd-hostnam" path="/run/systemd/default-hostname" dev="tmpfs" ino=12 ioctlcmd=0x5401 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1689891544.351:417): avc: denied { write } for pid=22094 comm="systemd-hostnam" name="systemd" dev="tmpfs" ino=2 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=dir permissive=1 node=localhost type=AVC msg=audit(1689891544.351:417): avc: denied { remove_name } for pid=22094 comm="systemd-hostnam" name="default-hostname" dev="tmpfs" ino=12 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=dir permissive=1 node=localhost type=AVC msg=audit(1689891544.351:417): avc: denied { unlink } for pid=22094 comm="systemd-hostnam" name="default-hostname" dev="tmpfs" ino=12 scontext=system_u:system_r:systemd_hostnamed_t:s0 tcontext=system_u:object_r:init_runtime_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-13 09:28:01 -04:00
Guido Trentalancia	2b0f35134a	Update the gnome module so that the gconf daemon is ... able to create Unix domain sockets and accept or listen connections on them. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/contrib/gnome.te | 2 ++ 1 file changed, 2 insertions(+)	2023-09-12 22:50:32 +02:00
Dave Sugar	7a635014e9	Fix some ssh agent denials ... Aug 29 21:38:07 localhost.localdomain audisp-syslog[1582]: node=localhost type=AVC msg=audit(1693345086.894:3623): avc: denied { write } for pid=1840 comm="ssh-agent" path="/home/sugar/.xsession-errors" dev="dm-9" ino=65541 scontext=staff_u:staff_r:staff_ssh_agent_t:s0 tcontext=system_u:object_r:xsession_log_t:s0 tclass=file permissive=1 Aug 29 21:38:07 localhost.localdomain audisp-syslog[1582]: node=localhost type=AVC msg=audit(1693345086.937:3634): avc: denied { getattr } for pid=1840 comm="ssh-agent" path="/usr/share/crypto-policies/FIPS/opensslcnf.txt" dev="dm-1" ino=262231 scontext=staff_u:staff_r:staff_ssh_agent_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1 Aug 29 21:38:07 localhost.localdomain audisp-syslog[1582]: node=localhost type=AVC msg=audit(1693345086.937:3635): avc: denied { read } for pid=1840 comm="ssh-agent" name="opensslcnf.txt" dev="dm-1" ino=262231 scontext=staff_u:staff_r:staff_ssh_agent_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1 Aug 29 21:38:07 localhost.localdomain audisp-syslog[1582]: node=localhost type=AVC msg=audit(1693345086.937:3635): avc: denied { open } for pid=1840 comm="ssh-agent" path="/usr/share/crypto-policies/FIPS/opensslcnf.txt" dev="dm-1" ino=262231 scontext=staff_u:staff_r:staff_ssh_agent_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-12 16:43:52 -04:00
Dave Sugar	ccc02fcf36	separate label for /etc/security/opasswd ... Seting /etc/security/opasswd to shadow_t has some negative side effects like the fact that pam_unix needs to read that. Once pam_unix can read shadow_t that changes the behavour of how pam_unix uses unix_update to update the password. So, this change defines the new type, shadow_history_t, for /etc/secuirty/opasswd. Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-12 15:52:20 -04:00
Dave Sugar	3cd6a8116c	Solve issue with no keyboard/mouse on X login screen ... Sep 08 03:15:59 localhost audisp-syslog[1620]: node=localhost type=AVC msg=audit(1694142959.038:650): avc: denied { getattr } for pid=1695 comm="Xorg" name="/" dev="sysfs" ino=1 scontext=system_u:system_r:xserver_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=filesystem permissive=0 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-12 15:44:01 -04:00
Chris PeBenito	d1759b92cb	Merge pull request #647 from gtrentalancia/x_fixes_pr ... Stricter yet more customizable xserver policy and three security bug fixes	2023-09-12 15:01:23 -04:00
Guido Trentalancia	54b4e52a12	Dbus creates Unix domain sockets not only for the ... system bus, but also for the session bus (in addition to connecting to them), so its policy module is modified accordingly. See also: https://github.com/SELinuxProject/refpolicy/pull/667 which was merged in the following commit: b4cb09a38c Date: Mon Sep 11 20:42:50 2023 +0200 Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/dbus.if | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)	2023-09-12 20:05:14 +02:00
Guido Trentalancia	3483d76720	Update the gpg module so that the application is able ... to fetch new keys from the network. Without this patch the following error is produced: $ gpg --recv-keys EA3A87F0A4EBA030E45DF2409E8C1AFBBEFFDB32 gpg: error running '/usr/bin/dirmngr': exit status 1 gpg: failed to start dirmngr '/usr/bin/dirmngr': Generic error gpg: can't connect to the dirmngr: Generic error gpg: keyserver receive failed: dirmngr is not installed Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/apps/gpg.te | 2 ++ 1 file changed, 2 insertions(+)	2023-09-12 19:36:27 +02:00
Guido Trentalancia	a6a7641605	Fix the shutdown policy in order to make use of ... the newly created file label and interface needed to manage the random seed file. Add the sys_boot capability permission that was missing in the shutdown domain in order to be able to reboot/shutdown correctly. Let the shutdown domain signal init and all other domains. Fix the shutdown executable file labels, as the executable normally lives in /sbin. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/admin/shutdown.fc | 4 +++- policy/modules/admin/shutdown.te | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-)	2023-09-12 19:27:51 +02:00
Guido Trentalancia	984897ba81	Create a new specific file label for the random seed ... file saved before shutting down or rebooting the system and rework the interface needed to manage such file. Use the newly created interface to fix the init policy and deprecate the old one in the kernel files module. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/kernel/files.if | 29 +++++++++++++++++++++++------ policy/modules/system/init.fc | 3 ++- policy/modules/system/init.if | 24 ++++++++++++++++++++++++ policy/modules/system/init.te | 7 +++++-- 4 files changed, 54 insertions(+), 9 deletions(-)	2023-09-12 19:26:43 +02:00
Chris PeBenito	49fcadb8bd	Merge pull request #668 from gtrentalancia/userdomain_fixes_pr ... Remove an unneeded logging interface from the userdomain module	2023-09-12 11:49:18 -04:00
Chris PeBenito	f3ab8cef4d	Merge pull request #667 from gtrentalancia/dbus_fixes_pr2 ... dbus creates Unix domain sockets	2023-09-12 11:34:12 -04:00
Guido Trentalancia	3ed8a9e4d0	Remove a logging interface from the userdomain module ... since it has now been moved to the xscreensaver domain. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/system/userdomain.if | 2 -- 1 file changed, 2 deletions(-)	2023-09-11 21:34:42 +02:00
Guido Trentalancia	b4cb09a38c	Dbus creates Unix domain sockets (in addition to ... listening on and connecting to them), so its policy module is modified accordingly. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/dbus.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)	2023-09-11 20:43:58 +02:00
Guido Trentalancia	be2070b445	Remove duplicate permissions in the xserver module ... xserver_restricted_role() interface. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/xserver.if | 2 -- 1 file changed, 2 deletions(-)	2023-09-11 19:32:59 +02:00
Guido Trentalancia	b83fe41629	Fix another security bug similar to the ones that ... have been recently fixed in the following two commits: 3eef4bc6fd Date: Sun Sep 3 17:40:30 2023 +0200 and: 7de535d65a6f0592cb47598a4fd456e399a86663 Date: Thu Sep 7 18:46:20 2023 +0200 Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/xserver.if | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)	2023-09-11 19:31:39 +02:00
Guido Trentalancia	f39caed39b	Fix another security bug companion of the one ... fixed in the following previous commit: 3eef4bc6fd Date: Sun Sep 3 17:40:30 2023 +0200 This time the bug is already effective in the following modules: virt, firstboot, wine and mono. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/xserver.if | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)	2023-09-11 19:30:57 +02:00
Guido Trentalancia	1c053e5223	Improved wording for the new xserver tunable policy ... booleans introduced with the previous three commits. Thanks to Christopher PeBenito for suggesting this. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/xserver.if | 6 +++--- policy/modules/services/xserver.te | 16 ++++++++-------- 2 files changed, 11 insertions(+), 11 deletions(-)	2023-09-11 19:30:12 +02:00
Chris PeBenito	d1b1076666	Merge pull request #652 from gtrentalancia/syslog_fixes_pr ... Increase general syslog daemon policy security by making network permissions tunable	2023-09-11 09:56:36 -04:00
Chris PeBenito	9967edaebe	Merge pull request #666 from gtrentalancia/mix_fixes_pr2 ... Miscellaneous fixes	2023-09-11 09:38:05 -04:00
Guido Trentalancia	5037801893	Remove a vulnerability introduced by a logging interface ... which allows to execute log files. This can be potentially used to execute malicious code or scripts previously written in log files. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/admin/logrotate.te | 1 - policy/modules/system/logging.if | 22 ---------------------- 2 files changed, 23 deletions(-)	2023-09-11 15:25:25 +02:00
Chris PeBenito	a5619fe755	Merge pull request #662 from dsugar100/search_xdm_run_dir ... Allow search xdm_var_run_t directories along with reading files.	2023-09-11 09:09:29 -04:00
Chris PeBenito	ce2493a5cc	Merge pull request #661 from gtrentalancia/mplayer_fixes_pr ... mplayer module fixes for vlc	2023-09-11 09:08:18 -04:00
Chris PeBenito	e0e63aa281	Merge pull request #660 from dsugar100/dm_read_hwdata ... Allow display manager to read hwdata	2023-09-11 09:07:47 -04:00
Chris PeBenito	8ffc5e7246	Merge pull request #658 from dsugar100/utempter_fix ... Updates for utempter	2023-09-11 09:05:54 -04:00
Chris PeBenito	272a6c902e	Merge pull request #657 from etbe/master ... Daemon to control authentication for Thunderbolt.	2023-09-11 09:04:47 -04:00
Chris PeBenito	77692ca0f6	Merge pull request #655 from dsugar100/dbus_start_stop_services ... Allow system_dbusd_t to start/stop all units	2023-09-11 09:03:28 -04:00
Chris PeBenito	83238ce3ae	Merge pull request #639 from gtrentalancia/openoffice_fixes_pr ... Minor fixes for the openoffice and xserver modules	2023-09-11 09:00:46 -04:00
Guido Trentalancia	9c4b0300ea	Remove misplaced permission from mount interface ... mount_exec. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/system/mount.if | 3 --- 1 file changed, 3 deletions(-)	2023-09-11 09:34:58 +02:00
Dave Sugar	a603b3913d	Allow search xdm_var_run_t directories along with reading files. ... Sep 07 23:30:46 localhost audisp-syslog[1669]: node=localhost type=AVC msg=audit(1694129445.663:3622): avc: denied { search } for pid=1844 comm="xhost" name="lightdm" dev="tmpfs" ino=1504 scontext=toor_u:staff_r:staff_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=dir permissive=0 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-07 22:21:14 -04:00
Guido Trentalancia	03bc14351f	Add permissions to read device sysctls to mplayer. ... Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/apps/mplayer.te | 1 + 1 file changed, 1 insertion(+)	2023-09-07 22:34:19 +02:00
Guido Trentalancia	15db7d14aa	Let mplayer to act as a dbus session bus client (needed ... by the vlc media player). Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/apps/mplayer.te | 5 +++++ 1 file changed, 5 insertions(+)	2023-09-07 21:44:19 +02:00
Dave Sugar	8dd1903281	Allow display manager to read hwdata ... Sep 01 01:53:02 localhost.localdomain audisp-syslog[1524]: node=localhost type=AVC msg=audit(1693533182.968:431): avc: denied { search } for pid=1744 comm="sddm-greeter" name="hwdata" dev="dm-1" ino=1726 scontext=system_u:system_r:xdm_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=dir permissive=1 Sep 01 01:53:02 localhost.localdomain audisp-syslog[1524]: node=localhost type=AVC msg=audit(1693533182.968:432): avc: denied { read } for pid=1744 comm="sddm-greeter" name="pnp.ids" dev="dm-1" ino=1730 scontext=system_u:system_r:xdm_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=file permissive=1 Sep 01 01:53:02 localhost.localdomain audisp-syslog[1524]: node=localhost type=AVC msg=audit(1693533182.968:432): avc: denied { open } for pid=1744 comm="sddm-greeter" path="/usr/share/hwdata/pnp.ids" dev="dm-1" ino=1730 scontext=system_u:system_r:xdm_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=file permissive=1 Sep 01 01:53:02 localhost.localdomain audisp-syslog[1524]: node=localhost type=AVC msg=audit(1693533182.974:433): avc: denied { getattr } for pid=1744 comm="sddm-greeter" path="/usr/share/hwdata/pnp.ids" dev="dm-1" ino=1730 scontext=system_u:system_r:xdm_t:s0 tcontext=system_u:object_r:hwdata_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-06 21:58:46 -04:00
Dave Sugar	56db40c099	Updates for utempter ... Fix label (for RedHat) which places utempter in /usr/libexec/utempter/utempter Allow utempter to write to xsession log Sep 07 01:30:50 localhost.localdomain audisp-syslog[1649]: node=localhost type=AVC msg=audit(1694050250.483:3994): avc: denied { write } for pid=1927 comm="utempter" path="/home/toor/.xsession-errors" dev="dm-9" ino=129543 scontext=toor_u:staff_r:utempter_t:s0 tcontext=toor_u:object_r:xsession_log_t:s0 tclass=file permissive=1 Sep 07 01:30:50 localhost.localdomain audisp-syslog[1649]: node=localhost type=AVC msg=audit(1694050250.485:3997): avc: denied { getattr } for pid=1927 comm="utempter" path="/home/toor/.xsession-errors" dev="dm-9" ino=129543 scontext=toor_u:staff_r:utempter_t:s0 tcontext=toor_u:object_r:xsession_log_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-06 21:52:05 -04:00
Russell Coker	3e2dd81a36	Daemon to control authentication for Thunderbolt. ... Signed-off-by: Russell Coker <russell@coker.com.au>	2023-09-07 07:17:00 +10:00
Guido Trentalancia	0a41b1c748	Update the openoffice module so that it can create ... Unix stream sockets with its own label and use them both as a client and a server. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/contrib/openoffice.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)	2023-09-06 22:35:59 +02:00
Guido Trentalancia	77de8cdd59	Let the openoffice domain manage fonts cache (fontconfig). ... Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/contrib/openoffice.te | 1 + 1 file changed, 1 insertion(+)	2023-09-06 22:28:40 +02:00
Dave Sugar	f7d61f6146	Allow system_dbusd_t to start/stop all units ... Examples of denials I'm seeing requiring this type of access: node=localhost type=USER_AVC msg=audit(1689811749.504:399): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=n/a uid=0 gid=81 path="/usr/lib/systemd/system/systemd-hostnamed.service" cmdline="/usr/bin/dbus-broker-launch --scope system --audit" function="bus_unit_method_start_generic" scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=service permissive=0 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'␝UID="root" AUID="unset" AUID="root" UID="root" GID="dbus" SAUID="root" node=localhost type=USER_AVC msg=audit(1692287535.229:262): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=n/a uid=0 gid=81 path="/usr/lib/systemd/system/systemd-logind.service" cmdline="/usr/bin/dbus-broker-launch --scope system --audit" function="bus_unit_method_start_generic" scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=service permissive=1 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'␝UID="root" AUID="unset" AUID="root" UID="root" GID="dbus" SAUID="root" node=localhost type=USER_AVC msg=audit(1692305808.055:375): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=n/a uid=0 gid=81 path="/usr/lib/systemd/system/accounts-daemon.service" cmdline="/usr/bin/dbus-broker-launch --scope system --audit" function="bus_unit_method_start_generic" scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:object_r:systemd_unit_t:s0 tclass=service permissive=0 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?' UID="root" AUID="unset" AUID="root" UID="root" GID="dbus" SAUID="root" Signed-off-by: Dave Sugar <dsugar100@gmail.com>	2023-09-06 16:22:46 -04:00
Guido Trentalancia	c032204af3	Introduce a new "logging_syslog_can_network" boolean ... and make the net_admin capability as well as all corenetwork permissions previously granted to the syslog daemon conditional upon such boolean being true. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/system/logging.te | 61 +++++++++++++++++++++++---------------- 1 file changed, 36 insertions(+), 25 deletions(-)	2023-09-06 20:53:42 +02:00
Chris PeBenito	9d03d2ef9e	Merge pull request #656 from gtrentalancia/kernel_fixes_pr ... Update the kernel module to remove misplaced or obsolete permissions	2023-09-06 13:29:48 -04:00
Chris PeBenito	663284394c	Merge pull request #654 from gtrentalancia/smartmon_fixes_pr ... Smartmon policy update	2023-09-06 13:28:08 -04:00
Chris PeBenito	246c1aab40	Merge pull request #653 from etbe/master ... Add iio-sensor-proxy.	2023-09-06 13:27:41 -04:00
Guido Trentalancia	7e5292de29	Update the kernel module to remove misplaced or at least really ... obsolete permissions during kernel module loading. Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/kernel/kernel.te | 12 ------------ 1 file changed, 12 deletions(-)	2023-09-06 17:50:52 +02:00
Guido Trentalancia	86f9bfe0ee	Revert the following commit (ability to read /usr files), ... as it is no longer needed, after the database file got its own label: Date: Wed Feb 16 07:24:34 2011 +0100 patch to allow smartmon to read usr files 37ba0d0437 Signed-off-by: Guido Trentalancia <guido@trentalancia.com> --- policy/modules/services/smartmon.te | 1 - 1 file changed, 1 deletion(-)	2023-09-06 17:12:48 +02:00