From d55213e04801baef4979cb38340737d69cb66d0c Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 19 Sep 2022 12:28:38 +0200 Subject: [PATCH] Allow winbind-rpcd read and write its key ring Addresses the following AVC denials: type=AVC msg=audit(1663577560.480:3619): avc: denied { write } for pid=109517 comm="samba-dcerpcd" scontext=system_u:system_r:winbind_rpcd_t:s0 tcontext=system_u:system_r:winbind_rpcd_t:s0 tclass=key permissive=1 type=AVC msg=audit(1663577560.480:3620): avc: denied { read } for pid=109517 comm="samba-dcerpcd" scontext=system_u:system_r:winbind_rpcd_t:s0 tcontext=system_u:system_r:winbind_rpcd_t:s0 tclass=key permissive=1 Resolves: rhbz#2127854 --- policy/modules/contrib/samba.te | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/contrib/samba.te b/policy/modules/contrib/samba.te index d25bc64f5d..23af3a1304 100644 --- a/policy/modules/contrib/samba.te +++ b/policy/modules/contrib/samba.te @@ -1167,6 +1167,7 @@ optional_policy(` # allow winbind_rpcd_t self:capability { setgid setuid }; +allow winbind_rpcd_t self:key { read write }; allow winbind_rpcd_t self:netlink_route_socket create_netlink_socket_perms; allow winbind_rpcd_t self:unix_dgram_socket { create_socket_perms sendto }; allow winbind_rpcd_t self:unix_stream_socket connectto;