blob: cc603e61267daed0925337d09ab3ca39a07a4e3b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
From a196f11f4a7f2f96cbf05614513204ca17aa0691 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Fri, 13 Oct 2017 07:20:40 +0000
Subject: [PATCH] policy/modules/kernel/kernel: make kernel_t MLS trusted for
lowering the level of files
The boot process hangs with the error while using MLS policy:
[!!!!!!] Failed to mount API filesystems, freezing.
[ 4.085349] systemd[1]: Freezing execution.
Make kernel_t mls trusted for lowering the level of files to fix below
avc denials and remove the hang issue.
op=security_validate_transition seresult=denied \
oldcontext=system_u:object_r:device_t:s15:c0.c1023 \
newcontext=system_u:object_r:device_t:s0 \
taskcontext=system_u:system_r:kernel_t:s15:c0.c1023 tclass=dir
systemd[1]: Unable to fix SELinux security context of /dev: Operation not permitted
avc: denied { create } for pid=1 comm="systemd" name="shm" \
scontext=system_u:system_r:kernel_t:s15:c0.c1023 \
tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir permissive=0
systemd[1]: Failed to mount tmpfs at /dev/shm: No such file or directory
avc: denied { create } for pid=1 comm="systemd" name="pts" \
scontext=system_u:system_r:kernel_t:s15:c0.c1023 \
tcontext=system_u:object_r:devpts_t:s0-s15:c0.c1023 tclass=dir permissive=0
op=security_validate_transition seresult=denied \
oldcontext=system_u:object_r:unlabeled_t:s0 \
newcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 \
taskcontext=system_u:system_r:kernel_t:s15:c0.c1023 tclass=dir
op=security_validate_transition seresult=denied \
oldcontext=system_u:object_r:tmpfs_t:s15:c0.c1023 \
newcontext=system_u:object_r:var_run_t:s0-s15:c0.c1023 \
taskcontext=system_u:system_r:kernel_t:s15:c0.c1023 tclass=dir
systemd[1]: Unable to fix SELinux security context of /run: Operation not permitted
op=security_validate_transition seresult=denied \
oldcontext=system_u:object_r:tmpfs_t:s15:c0.c1023 \
newcontext=system_u:object_r:cgroup_t:s0 \
taskcontext=system_u:system_r:kernel_t:s15:c0.c1023 tclass=dir
systemd[1]: Unable to fix SELinux security context of /sys/fs/cgroup: Operation not permitted
avc: denied { create } for pid=1 comm="systemd" name="pstore" \
scontext=system_u:system_r:kernel_t:s15:c0.c1023 \
tcontext=system_u:object_r:pstore_t:s0 tclass=dir permissive=0
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=667370
Upstream-Status: Inappropriate [embedded specific]
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
policy/modules/kernel/kernel.te | 2 ++
1 file changed, 2 insertions(+)
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 6c35a2374..ebde22e02 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -383,6 +383,8 @@ mls_file_write_all_levels(kernel_t)
mls_file_read_all_levels(kernel_t)
mls_socket_write_all_levels(kernel_t)
mls_fd_use_all_levels(kernel_t)
+# https://bugzilla.redhat.com/show_bug.cgi?id=667370
+mls_file_downgrade(kernel_t)
ifdef(`distro_redhat',`
# Bugzilla 222337
--
2.25.1
|
