nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

networkmanager: allow watch etc_t and lib_t

Browse Source 
node=localhost type=AVC msg=audit(1663293513.722:361): avc:  denied  { watch } for  pid=1060 comm="NetworkManager" path="/etc" dev="dm-0" ino=261122 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0
node=localhost type=AVC msg=audit(1663293513.872:369): avc:  denied  { watch } for  pid=1060 comm="NetworkManager" path="/usr/lib/NetworkManager/VPN" dev="dm-0" ino=656514 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=dir permissive=0

Signed-off-by: Dave Sugar <dsugar100@gmail.com>
This commit is contained in:
Dave Sugar 2022-09-15 22:22:07 -04:00
parent f5bb0f4fe8
commit a035f86cbd
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
policy/modules/services/networkmanager.te
View File

@ -145,6 +145,7 @@ files_manage_etc_symlinks(NetworkManager_t)
files_read_etc_runtime_files(NetworkManager_t)
files_read_usr_files(NetworkManager_t)
files_read_usr_src_files(NetworkManager_t)
files_watch_etc_dirs(NetworkManager_t)
fs_getattr_all_fs(NetworkManager_t)
fs_search_auto_mountpoints(NetworkManager_t)
@ -166,6 +167,8 @@ auth_use_nsswitch(NetworkManager_t)
logging_send_audit_msgs(NetworkManager_t)
logging_send_syslog_msg(NetworkManager_t)
libs_watch_lib_dirs(NetworkManager_t)
miscfiles_read_generic_certs(NetworkManager_t)
miscfiles_read_localization(NetworkManager_t)

18
policy/modules/system/libraries.if
View File

@ -276,6 +276,24 @@ interface(`libs_manage_lib_dirs',`
allow $1 lib_t:dir manage_dir_perms;
')
########################################
## <summary>
## Watch /usr/lib directories
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`libs_watch_lib_dirs',`
gen_require(`
type lib_t;
')
allow $1 lib_t:dir watch;
')
########################################
## <summary>
## dontaudit attempts to setattr on library files