31 lines
1.9 KiB
Diff
31 lines
1.9 KiB
Diff
From f8f11f18a9473614c47b0a35d27f5be11c954e5b Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Mon, 27 Jun 2022 13:28:39 +0200
|
|
Subject: [PATCH] Allow keepalived read the contents of the sysfs filesystem
|
|
|
|
Addresses the following AVC denial which is triggered on the keepalived
|
|
service start when it tries to read /sys/devices/system/cpu:
|
|
|
|
type=PROCTITLE msg=audit(06/17/2022 08:19:59.448:341) : proctitle=/usr/sbin/keepalived --dont-fork -D
|
|
type=PATH msg=audit(06/17/2022 08:19:59.448:341) : item=0 name=/sys/devices/system/cpu inode=39 dev=00:16 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
|
|
type=SYSCALL msg=audit(06/17/2022 08:19:59.448:341) : arch=x86_64 syscall=openat success=yes exit=12 a0=AT_FDCWD a1=0x7ff4be2afc3f a2=O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC a3=0x0 items=1 ppid=4449 pid=4451 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=keepalived exe=/usr/sbin/keepalived subj=system_u:system_r:keepalived_t:s0 key=(null)
|
|
type=AVC msg=audit(06/17/2022 08:19:59.448:341) : avc: denied { read } for pid=4451 comm=keepalived name=cpu dev="sysfs" ino=39 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=1
|
|
|
|
Resolves: rhbz#2098130
|
|
---
|
|
policy/modules/contrib/keepalived.te | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/policy/modules/contrib/keepalived.te b/policy/modules/contrib/keepalived.te
|
|
index 8b5ca7171a..0879eeb4ec 100644
|
|
--- a/policy/modules/contrib/keepalived.te
|
|
+++ b/policy/modules/contrib/keepalived.te
|
|
@@ -81,6 +81,7 @@ corenet_tcp_connect_squid_port(keepalived_t)
|
|
domain_read_all_domains_state(keepalived_t)
|
|
domain_getattr_all_domains(keepalived_t)
|
|
|
|
+dev_read_sysfs(keepalived_t)
|
|
dev_read_urand(keepalived_t)
|
|
|
|
files_dontaudit_mounton_rootfs(keepalived_var_run_t)
|