From d6bb54218c4b3f5cbed4c3b7115dc43793ebdcba Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Wed, 16 Nov 2022 16:37:54 +0100 Subject: [PATCH] Allow rpc.gssd read network sysctls Addresses the following AVC denial: type=AVC msg=audit(1668606673.80:374): avc: denied { read } for pid=1236 comm="rpc.gssd" name="disable_ipv6" dev="proc" ino=32004 scontext=system_u:system_r:gssd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file permissive=0 Resolves: rhbz#2143271 --- policy/modules/contrib/rpc.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/modules/contrib/rpc.te b/policy/modules/contrib/rpc.te index a13661a797..f94cfa5d24 100644 --- a/policy/modules/contrib/rpc.te +++ b/policy/modules/contrib/rpc.te @@ -369,7 +369,7 @@ kernel_read_system_state(gssd_t) kernel_read_network_state(gssd_t) kernel_read_network_state_symlinks(gssd_t) kernel_request_load_module(gssd_t) -kernel_search_network_sysctl(gssd_t) +kernel_read_net_sysctls(gssd_t) kernel_signal(gssd_t) corecmd_exec_bin(gssd_t)