Skip to content

Commit

Permalink
Allow login_userdomain connect to systemd-homed over a unix socket
Browse files Browse the repository at this point in the history
The commit addresses the following AVC denial:
type=PROCTITLE msg=audit(10/04/2024 08:43:54.462:5944) : proctitle=id
type=PATH msg=audit(10/04/2024 08:43:54.462:5944) : item=0 name=/run/systemd/userdb/io.systemd.Home inode=1752 dev=00:1b mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=SOCKADDR msg=audit(10/04/2024 08:43:54.462:5944) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Home }
type=SYSCALL msg=audit(10/04/2024 08:43:54.462:5944) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x9 a1=0x7ffe279c6df0 a2=0x26 a3=0x563dd3733740 items=1 ppid=161562 pid=161563 auid=user11355 uid=user11355 gid=user11355 euid=user11355 suid=user11355 fsuid=user11355 egid=user11355 sgid=user11355 fsgid=user11355 tty=pts2 ses=93 comm=id exe=/usr/bin/id subj=guest_u:guest_r:guest_t:s0 key=(null)
type=AVC msg=audit(10/04/2024 08:43:54.462:5944) : avc:  denied  { connectto } for  pid=161563 comm=id path=/run/systemd/userdb/io.systemd.Home scontext=guest_u:guest_r:guest_t:s0 tcontext=system_u:system_r:systemd_homed_t:s0 tclass=unix_stream_socket permissive=0
  • Loading branch information
zpytela committed Oct 7, 2024
1 parent ef380b8 commit 2d925e2
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions policy/modules/system/userdomain.te
Original file line number Diff line number Diff line change
Expand Up @@ -497,6 +497,10 @@ optional_policy(`
systemd_tmpfiles_exec(login_userdomain)
')

optional_policy(`
systemd_homed_stream_connect(login_userdomain)
')

optional_policy(`
xserver_stream_accept_xdm(login_userdomain)
')
Expand Down

0 comments on commit 2d925e2

Please sign in to comment.