commit: b1a213b26e58f32d250057fcb9e1af3a9f05a63d
Author: Christian Göttsche <cgzones <AT> googlemail <DOT> com>
AuthorDate: Thu Feb 22 17:00:46 2024 +0000
Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Fri Mar 1 17:05:51 2024 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b1a213b2
vnstatd: update
type=PROCTITLE msg=audit(21/02/24 22:54:36.792:69) :
proctitle=/usr/sbin/vnstatd -n
type=PATH msg=audit(21/02/24 22:54:36.792:69) : item=0 name=/dev/urandom
inode=18 dev=00:2b mode=character,666 ouid=root ogid=root rdev=01:09
obj=system_u:object_r:urandom_device_t:s0 nametype=NORMAL cap_fp=none
cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(21/02/24 22:54:36.792:69) : cwd=/
type=SYSCALL msg=audit(21/02/24 22:54:36.792:69) : arch=x86_64
syscall=openat success=yes exit=5 a0=AT_FDCWD a1=0x7f197cc66865
a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=900 auid=unset uid=vnstat
gid=vnstat euid=vnstat suid=vnstat fsuid=vnstat egid=vnstat sgid=vnstat
fsgid=vnstat tty=(none) ses=unset comm=vnstatd exe=/usr/sbin/vnstatd
subj=system_u:system_r:vnstatd_t:s0 key=(null)
type=AVC msg=audit(21/02/24 22:54:36.792:69) : avc: denied { open } for
pid=900 comm=vnstatd path=/dev/urandom dev=tmpfs ino=18
scontext=system_u:system_r:vnstatd_t:s0
tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file permissive=1
type=AVC msg=audit(21/02/24 22:54:36.792:69) : avc: denied { read } for
pid=900 comm=vnstatd name=urandom dev=tmpfs ino=18
scontext=system_u:system_r:vnstatd_t:s0
tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file permissive=1
Signed-off-by: Christian Göttsche <cgzones <AT> googlemail.com>
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>
policy/modules/services/vnstatd.te | 1 +
1 file changed, 1 insertion(+)
diff --git a/policy/modules/services/vnstatd.te
b/policy/modules/services/vnstatd.te
index f8274d451..3be384a9a 100644
--- a/policy/modules/services/vnstatd.te
+++ b/policy/modules/services/vnstatd.te
@@ -48,6 +48,7 @@ kernel_read_system_state(vnstatd_t)
# read /sys/class/net/eth0
dev_read_sysfs(vnstatd_t)
+dev_read_urand(vnstatd_t)
files_read_etc_files(vnstatd_t)
files_search_var_lib(vnstatd_t)
