From aa7e8d40914cc671dc4be270cfc9424d8d978821 Mon Sep 17 00:00:00 2001 From: Nicolas Iooss Date: Sun, 1 Sep 2019 20:44:14 +0200 Subject: [PATCH] ntp: allow systemd-timesyncd to read network status systemd-timesyncd uses network_is_online() [1], which calls sd_network_get_operational_state() [2], which reads /run/systemd/netif/state [3]: r = parse_env_file(NULL, "/run/systemd/netif/state", "OPER_STATE", &s); On a Debian virtual machine created with Vagrant, /run/systemd/netif/state contains: # This is private data. Do not parse. OPER_STATE=routable DNS=192.168.121.1 172.28.128.1 systemd-timesyncd's access produces the following logs: type=AVC msg=audit(1567359197.660:323): avc: denied { read } for pid=230 comm="systemd-timesyn" name="state" dev="tmpfs" ino=24564 scontext=system_u:system_r:ntpd_t tcontext=system_u:object_r:systemd_networkd_var_run_t tclass=file permissive=1 type=AVC msg=audit(1567359197.660:324): avc: denied { open } for pid=230 comm="systemd-timesyn" path="/run/systemd/netif/state" dev="tmpfs" ino=24564 scontext=system_u:system_r:ntpd_t tcontext=system_u:object_r:systemd_networkd_var_run_t tclass=file permissive=1 type=AVC msg=audit(1567359197.660:325): avc: denied { getattr } for pid=230 comm="systemd-timesyn" path="/run/systemd/netif/state" dev="tmpfs" ino=24564 scontext=system_u:system_r:ntpd_t tcontext=system_u:object_r:systemd_networkd_var_run_t tclass=file permissive=1 Allow these accesses. [1] https://github.com/systemd/systemd/blob/v242/src/timesync/timesyncd.c#L158 [2] https://github.com/systemd/systemd/blob/v242/src/libsystemd/sd-network/network-util.c#L13 [3] https://github.com/systemd/systemd/blob/v242/src/libsystemd/sd-network/sd-network.c#L27 Signed-off-by: Nicolas Iooss --- policy/modules/services/ntp.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te index a1fbcada7..43e1fcf4c 100644 --- a/policy/modules/services/ntp.te +++ b/policy/modules/services/ntp.te @@ -156,6 +156,8 @@ ifdef(`init_systemd',` # for /run/systemd/netif/links systemd_list_networkd_runtime(ntpd_t) + # for /run/systemd/netif/state + systemd_read_networkd_runtime(ntpd_t) optional_policy(` chronyd_enabledisable(ntpd_t)