diff options
| author |   Christian Göttsche <cgzones@googlemail.com> | 2024-02-22 18:00:52 +0100 |
|---|---|---|
| committer |   Kenton Groombridge <concord@gentoo.org> | 2024-03-01 12:05:56 -0500 |
| commit | 007072b1c66cfb28310f9d0449f8167f496be2ae (patch) | |
| tree | 00dd5fbbecc50f697d5afb2148d3239631588d8d | |
| parent | udev: update (diff) | |
| download | hardened-refpolicy-007072b1c66cfb28310f9d0449f8167f496be2ae.tar.gz hardened-refpolicy-007072b1c66cfb28310f9d0449f8167f496be2ae.tar.bz2 hardened-refpolicy-007072b1c66cfb28310f9d0449f8167f496be2ae.zip | |
systemd: logind update
type=PROCTITLE msg=audit(21/02/24 23:31:52.659:83) : proctitle=/usr/lib/systemd/systemd-logind
type=SYSCALL msg=audit(21/02/24 23:31:52.659:83) : arch=x86_64 syscall=recvmsg success=yes exit=24 a0=0xf a1=0x7ffdec4e7bc0 a2=MSG_DONTWAIT|MSG_CMSG_CLOEXEC a3=0x0 items=0 ppid=1 pid=909 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null)
type=AVC msg=audit(21/02/24 23:31:52.659:83) : avc: denied { use } for pid=909 comm=systemd-logind path=anon_inode:[pidfd] dev="anon_inodefs" ino=1051 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0 tclass=fd permissive=1
p.s.: this might need an overhaul after pidfd handling in the kernel has
been improved.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
| -rw-r--r-- | policy/modules/system/systemd.te | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index e3af88033..cef49e9a3 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -1053,6 +1053,9 @@ storage_raw_read_fixed_disk_cond(systemd_logind_t, systemd_logind_get_bootloader optional_policy(` dbus_connect_system_bus(systemd_logind_t) dbus_system_bus_client(systemd_logind_t) + + # pidfd + dbus_use_system_bus_fds(systemd_logind_t) ') optional_policy(` |