From 0e9856f3cd11af60445ccf12cd59d35662a7e9a2 Mon Sep 17 00:00:00 2001 From: Nikola Knazekova Date: Mon, 1 Aug 2022 16:08:08 +0200 Subject: [PATCH] Allow networkmanager to signal unconfined process During kernel selftests, teamd - running in NetworkManager_t domain, checks if teamd instance is started externally. Teamd is a daemon to control a given team network device and when started from command line, it runs in the caller domain - unconfined_t. time->Fri Apr 8 11:01:16 2022 type=PROCTITLE msg=audit(1649430076.436:6807): proctitle=2F7573722F62696E2F7465616D64002D6B002D74006C6167 type=SYSCALL msg=audit(1649430076.436:6807): arch=c000003e syscall=62 success=no exit=-13 a0=1ad7f5 a1=f a2=0 a3=7fbf0f5d6ac0 items=0 ppid=13470 pid=1759420 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="teamd" exe="/usr/bin/teamd" subj=system_u:system_r:NetworkManager_t:s0 key=(null) type=AVC msg=audit(1649430076.436:6807): avc: denied { signal } for pid=1759420 comm="teamd" scontext=system_u:system_r:NetworkManager_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0 Allow NetworkManager_t to send generic signals to the unconfined domain. Fix: bz#2074414 --- policy/modules/contrib/networkmanager.te | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/contrib/networkmanager.te b/policy/modules/contrib/networkmanager.te index a946bc060b..c827f40785 100644 --- a/policy/modules/contrib/networkmanager.te +++ b/policy/modules/contrib/networkmanager.te @@ -532,6 +532,7 @@ optional_policy(` optional_policy(` unconfined_dgram_send(NetworkManager_t) + unconfined_signal(NetworkManager_t) ')