From f5d181f909dc380ede72219ede558ed4052c143f Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 10 Oct 2022 16:47:39 +0200 Subject: [PATCH] Allow vlock search the contents of the /dev/pts directory Addresses the following AVC denial: type=PROCTITLE msg=audit(08/31/2022 09:28:27.751:867) : proctitle=vlock type=PATH msg=audit(08/31/2022 09:28:27.751:867) : item=0 name=/dev/pts/1 nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=SYSCALL msg=audit(08/31/2022 09:28:27.751:867) : arch=x86_64 syscall=stat success=no exit=EACCES(Permission denied) a0=0x55b5ce6f0b60 a1=0x7ffdd6518320 a2=0x7ffdd6518320 a3=0x0 items=1 ppid=9040 pid=12550 auid=sysadm-user uid=sysadm-user gid=sysadm-user euid=sysadm-user suid=sysadm-user fsuid=sysadm-user egid=sysadm-user sgid=sysadm-user fsgid=sysadm-user tty=pts1 ses=17 comm=vlock exe=/usr/bin/vlock subj=sysadm_u:sysadm_r:vlock_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(08/31/2022 09:28:27.751:867) : avc: denied { search } for pid=12550 comm=vlock name=/ dev="devpts" ino=1 scontext=sysadm_u:sysadm_r:vlock_t:s0-s0:c0.c1023 tcontext=system_u:object_r:devpts_t:s0 tclass=dir permissive=0 Resolves: rhbz#2122838 --- policy/modules/contrib/vlock.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/contrib/vlock.te b/policy/modules/contrib/vlock.te index de409cc610..418f2f7ab5 100644 --- a/policy/modules/contrib/vlock.te +++ b/policy/modules/contrib/vlock.te @@ -40,5 +40,7 @@ init_dontaudit_rw_utmp(vlock_t) logging_send_syslog_msg(vlock_t) +term_search_ptys(vlock_t) + userdom_dontaudit_search_user_home_dirs(vlock_t) userdom_use_inherited_user_terminals(vlock_t)