From fe7e3605b466b15a2cbcc21e622451fa7266ef3d Mon Sep 17 00:00:00 2001 From: Yi Zhao Date: Mon, 26 Aug 2024 19:48:29 +0800 Subject: systemd: fix policy for systemd-ssh-generator Fixes: avc: denied { getattr } for pid=121 comm="systemd-ssh-gen" path="/usr/sbin/sshd" dev="vda" ino=7787 scontext=system_u:system_r:systemd_generator_t tcontext=system_u:object_r:sshd_exec_t tclass=file permissive=1 avc: denied { execute } for pid=121 comm="systemd-ssh-gen" name="sshd" dev="vda" ino=7787 scontext=system_u:system_r:systemd_generator_t tcontext=system_u:object_r:sshd_exec_t tclass=file permissive=1 avc: denied { create } for pid=121 comm="systemd-ssh-gen" scontext=system_u:system_r:systemd_generator_t tcontext=system_u:system_r:systemd_generator_t tclass=vsock_socket permissive=1 avc: denied { read } for pid=121 comm="systemd-ssh-gen" name="vsock" dev="devtmpfs" ino=152 scontext=system_u:system_r:systemd_generator_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 avc: denied { open } for pid=121 comm="systemd-ssh-gen" path="/dev/vsock" dev="devtmpfs" ino=152 scontext=system_u:system_r:systemd_generator_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 avc: denied { ioctl } for pid=121 comm="systemd-ssh-gen" path="/dev/vsock" dev="devtmpfs" ino=152 ioctlcmd=0x7b9 scontext=system_u:system_r:systemd_generator_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 Signed-off-by: Yi Zhao Signed-off-by: Jason Zaman --- policy/modules/system/systemd.te | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index 2f9d12fc..f0c7a434 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -542,6 +542,8 @@ seutil_search_default_contexts(systemd_coredump_t) allow systemd_generator_t self:fifo_file rw_fifo_file_perms; allow systemd_generator_t self:capability { dac_override sys_admin sys_resource }; allow systemd_generator_t self:process { getcap getsched setfscreate signal }; +# for systemd-ssh-generator +allow systemd_generator_t self:vsock_socket create; corecmd_exec_shell(systemd_generator_t) corecmd_exec_bin(systemd_generator_t) @@ -552,6 +554,8 @@ dev_write_sysfs_dirs(systemd_generator_t) dev_read_urand(systemd_generator_t) dev_create_sysfs_files(systemd_generator_t) dev_write_sysfs(systemd_generator_t) +# for systemd-ssh-generator +dev_read_vsock(systemd_generator_t) files_read_etc_files(systemd_generator_t) files_read_etc_runtime_files(systemd_generator_t) @@ -639,6 +643,11 @@ optional_policy(` rpc_read_exports(systemd_generator_t) ') +optional_policy(` + # needed by systemd-ssh-generator + ssh_exec_sshd(systemd_generator_t) +') + optional_policy(` # needed by zfs-mount-generator zfs_read_config(systemd_generator_t) -- cgit v1.2.3-65-gdbad