From f8f11f18a9473614c47b0a35d27f5be11c954e5b Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 27 Jun 2022 13:28:39 +0200 Subject: [PATCH] Allow keepalived read the contents of the sysfs filesystem Addresses the following AVC denial which is triggered on the keepalived service start when it tries to read /sys/devices/system/cpu: type=PROCTITLE msg=audit(06/17/2022 08:19:59.448:341) : proctitle=/usr/sbin/keepalived --dont-fork -D type=PATH msg=audit(06/17/2022 08:19:59.448:341) : item=0 name=/sys/devices/system/cpu inode=39 dev=00:16 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=SYSCALL msg=audit(06/17/2022 08:19:59.448:341) : arch=x86_64 syscall=openat success=yes exit=12 a0=AT_FDCWD a1=0x7ff4be2afc3f a2=O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC a3=0x0 items=1 ppid=4449 pid=4451 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=keepalived exe=/usr/sbin/keepalived subj=system_u:system_r:keepalived_t:s0 key=(null) type=AVC msg=audit(06/17/2022 08:19:59.448:341) : avc: denied { read } for pid=4451 comm=keepalived name=cpu dev="sysfs" ino=39 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=1 Resolves: rhbz#2098130 --- policy/modules/contrib/keepalived.te | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/contrib/keepalived.te b/policy/modules/contrib/keepalived.te index 8b5ca7171a..0879eeb4ec 100644 --- a/policy/modules/contrib/keepalived.te +++ b/policy/modules/contrib/keepalived.te @@ -81,6 +81,7 @@ corenet_tcp_connect_squid_port(keepalived_t) domain_read_all_domains_state(keepalived_t) domain_getattr_all_domains(keepalived_t) +dev_read_sysfs(keepalived_t) dev_read_urand(keepalived_t) files_dontaudit_mounton_rootfs(keepalived_var_run_t)