From 21351f6bd971db0f25f58756f3e798f79e778b14 Mon Sep 17 00:00:00 2001 From: "Sugar, David" Date: Thu, 7 Feb 2019 21:15:32 +0000 Subject: [PATCH] Allow systemd-networkd to get IP address from dhcp server I'm seeing the following denials when attempting to get a DHCP address. type=AVC msg=audit(1549471325.440:199): avc: denied { name_bind } for pid=6964 comm="systemd-network" src=68 scontext=system_u:system_r:systemd_networkd_t:s0 tcontext=system_u:object_r:dhcpc_port_t:s0 tclass=udp_socket permissive=1 type=AVC msg=audit(1549471325.440:199): avc: denied { node_bind } for pid=6964 comm="systemd-network" saddr=10.1.12.61 src=68 scontext=system_u:system_r:systemd_networkd_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=udp_socket permissive=1 type=AVC msg=audit(1549471325.440:199): avc: denied { net_bind_service } for pid=6964 comm="systemd-network" capability=10 scontext=system_u:system_r:systemd_networkd_t:s0 tcontext=system_u:system_r:systemd_networkd_t:s0 tclass=capability permissive=1 type=SYSCALL msg=audit(1549471325.440:199): arch=c000003e syscall=49 success=yes exit=0 a0=b a1=7fff09388780 a2=10 a3=7fff09388778 items=0 ppid=1 pid=6964 auid=4294967295 uid=192 gid=192 euid=192 suid=192 fsuid=192 egid=192 sgid=192 fsgid=192 tty=(none) ses=4294967295 comm="systemd-network" exe="/usr/lib/systemd/systemd-networkd" subj=system_u:system_r:systemd_networkd_t:s0 key=(null) Signed-off-by: Dave Sugar --- policy/modules/system/systemd.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index a6f09dfd2..2321fa16d 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -636,6 +636,8 @@ corecmd_bin_entry_type(systemd_networkd_t) corecmd_exec_bin(systemd_networkd_t) corenet_rw_tun_tap_dev(systemd_networkd_t) +corenet_udp_bind_dhcpc_port(systemd_networkd_t) +corenet_udp_bind_generic_node(systemd_networkd_t) dev_read_urand(systemd_networkd_t) dev_read_sysfs(systemd_networkd_t)