Skip to content

Commit

Permalink
Allow virtstoraged get attributes of configfs dirs
Browse files Browse the repository at this point in the history
The commit addresses the following AVC denial:
type=AVC msg=audit(1724038118.935:800): avc:  denied  { getattr } for  pid=16121 comm="daemon-init" path="/sys/kernel/config" dev="configfs" ino=6163 scontext=system_u:system_r:virtstoraged_t:s0 tcontext=system_u:object_r:configfs_t:s0 tclass=dir permissive=1

Resolves: rhbz#2305656
  • Loading branch information
zpytela committed Sep 4, 2024
1 parent 7ece861 commit 5d34a85
Show file tree
Hide file tree
Showing 2 changed files with 19 additions and 0 deletions.
1 change: 1 addition & 0 deletions policy/modules/contrib/virt.te
Original file line number Diff line number Diff line change
Expand Up @@ -2339,6 +2339,7 @@ kernel_io_uring_use(virtstoraged_t)
corecmd_exec_bin(virtstoraged_t)

fs_getattr_all_fs(virtstoraged_t)
fs_getattr_configfs_dirs(virtstoraged_t)

userdom_read_user_home_content_files(virtstoraged_t)

Expand Down
18 changes: 18 additions & 0 deletions policy/modules/kernel/filesystem.if
Original file line number Diff line number Diff line change
Expand Up @@ -2062,6 +2062,24 @@ interface(`fs_dontaudit_write_configfs_dirs',`
dontaudit $1 configfs_t:dir write;
')

#######################################
## <summary>
## Getattr dirs on a configfs filesystem.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`fs_getattr_configfs_dirs',`
gen_require(`
type configfs_t;
')

allow $1 configfs_t:dir getattr;
')

#######################################
## <summary>
## Read dirs
Expand Down

0 comments on commit 5d34a85

Please sign in to comment.