Skip to content

Commit

Permalink
Allow unprivileged user watch /run/systemd
Browse files Browse the repository at this point in the history
This is similar to commit 8b480be ("Allow staff use watch /run/systemd"),
just for user_t.

The commit addresses the following AVC denial:
type=AVC msg=audit(1725791489.845:352): avc:  denied  { watch } for  pid=5967 comm="cockpit-bridge" path="/run/systemd" dev="tmpfs" ino=2 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=0

Resolves: rhbz#2310648
  • Loading branch information
zpytela committed Sep 13, 2024
1 parent 1a7d7f4 commit 6939d61
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions policy/modules/roles/unprivuser.te
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ seutil_read_module_store(user_t)

init_dbus_chat(user_t)
init_status(user_t)
init_watch_pid_dir(user_t)

mount_signal(user_t)
mount_run_ecryptmount(user_t, user_r)
Expand Down

0 comments on commit 6939d61

Please sign in to comment.