commit: d50193d70d6d2620c82c112a534d36a6ff06e6ea
Author: Dave Sugar <dsugar100 <AT> gmail <DOT> com>
AuthorDate: Fri Aug 26 12:45:38 2022 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Sep 3 19:07:50 2022 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=d50193d7
systemd: systemd-update-done fix startup issue
Seeing error:
Failed to initalize SELinux labeling handle: No such file or directory
but no denials. With strace (and looking at source) found it is
opening /etc/selinux/config
openat(AT_FDCWD, "/etc/selinux/config", O_RDONLY|O_CLOEXEC) = 3
but that was dontaudited.
allow systemd_update_done_t file_type:filesystem getattr;
allow systemd_update_done_t selinux_config_t:dir { getattr open search };
dontaudit systemd_update_done_t selinux_config_t:dir { getattr open search };
dontaudit systemd_update_done_t selinux_config_t:file { getattr ioctl lock open
read };
These changes fix the issue
Signed-off-by: Dave Sugar <dsugar100 <AT> gmail.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/system/systemd.te | 1 +
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 2dc8b901..1eb35aa4 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1752,6 +1752,7 @@ kernel_read_kernel_sysctls(systemd_update_done_t)
selinux_use_status_page(systemd_update_done_t)
+seutil_read_config(systemd_update_done_t)
seutil_read_file_contexts(systemd_update_done_t)
systemd_log_parse_environment(systemd_update_done_t)
