Skip to content

[DRAFT] Dontaudit AVCs related to RHEL-37631 #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kkaarreell wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[DRAFT] Dontaudit AVCs related to RHEL-37631 #22

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions local_dontaudit.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,25 @@ type systemd_gpt_generator_t;
type syslogd_t;
type var_log_t;
type fixed_disk_device_t;

# RHEL-37631
type init_t;
type systemd_fstab_generator_t;
type nfsd_t;
type systemd_gpt_generator_t;
type systemd_rc_local_generator_t;
type systemd_sysv_generator_t;
}



dontaudit syslogd_t var_log_t:file { relabelfrom relabelto };
dontaudit systemd_gpt_generator_t systemd_gpt_generator_t:capability sys_admin;
dontaudit systemd_gpt_generator_t fixed_disk_device_t:blk_file write;

# workaround known issue https://issues.redhat.com/browse/RHEL-37631
dontaudit nfsd_t init_t:bpf {map_read map_write};
dontaudit systemd_fstab_generator_t init_t:bpf {map_read map_write};
dontaudit systemd_gpt_generator_t init_t:bpf {map_read map_write};
dontaudit systemd_rc_local_generator_t init_t:bpf {map_read map_write};
dontaudit systemd_sysv_generator_t init_t:bpf {map_read map_write};