diff options
| author |   Dave Sugar <dsugar100@gmail.com> | 2022-08-24 10:32:45 -0400 |
|---|---|---|
| committer |   Jason Zaman <perfinion@gentoo.org> | 2022-09-03 12:07:49 -0700 |
| commit | 087ca14923766efc87202a6b8a98f701105ff7a1 (patch) | |
| tree | 3e1eb8981f792f1482f35dade0965accfcc56568 | |
| parent | ssh: allow ssh_keygen to read /usr/share/crypto-policies/ (diff) | |
| download | hardened-refpolicy-087ca14923766efc87202a6b8a98f701105ff7a1.tar.gz hardened-refpolicy-087ca14923766efc87202a6b8a98f701105ff7a1.tar.bz2 hardened-refpolicy-087ca14923766efc87202a6b8a98f701105ff7a1.zip | |
chronyd: Allow to read fips_enabled sysctl
node=localhost type=AVC msg=audit(1661344394.902:355): avc: denied { search } for pid=1014 comm="chronyd" name="crypto" dev="proc" ino=10742 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir permissive=1
node=localhost type=AVC msg=audit(1661344394.902:355): avc: denied { read } for pid=1014 comm="chronyd" name="fips_enabled" dev="proc" ino=10743 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1661344394.902:355): avc: denied { open } for pid=1014 comm="chronyd" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=10743 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1661344394.902:356): avc: denied { getattr } for pid=1014 comm="chronyd" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=10743 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
| -rw-r--r-- | policy/modules/services/chronyd.te | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/policy/modules/services/chronyd.te b/policy/modules/services/chronyd.te index 3354485c..0cf41d3d 100644 --- a/policy/modules/services/chronyd.te +++ b/policy/modules/services/chronyd.te @@ -81,6 +81,7 @@ manage_files_pattern(chronyd_t, chronyd_runtime_t, chronyd_runtime_t) manage_sock_files_pattern(chronyd_t, chronyd_runtime_t, chronyd_runtime_t) files_runtime_filetrans(chronyd_t, chronyd_runtime_t, { dir file sock_file }) +kernel_read_crypto_sysctls(chronyd_t) kernel_read_system_state(chronyd_t) kernel_read_network_state(chronyd_t) |