diff options
| author |   Dave Sugar <dsugar100@gmail.com> | 2022-08-24 10:37:54 -0400 |
|---|---|---|
| committer |   Jason Zaman <perfinion@gentoo.org> | 2022-09-03 12:07:49 -0700 |
| commit | 86b5f035516e0a10b3af98732667d2c4cb08b79c (patch) | |
| tree | 032edb89eea121488fc8de1a2524f4c665123c68 | |
| parent | chronyd: Allow to read fips_enabled sysctl (diff) | |
| download | hardened-refpolicy-86b5f035516e0a10b3af98732667d2c4cb08b79c.tar.gz hardened-refpolicy-86b5f035516e0a10b3af98732667d2c4cb08b79c.tar.bz2 hardened-refpolicy-86b5f035516e0a10b3af98732667d2c4cb08b79c.zip | |
chronyd: allow chronyd to read /usr/share/crypto-policies
With RHEL9 /etc/crypto-policies/back-ends are symlinks to /usr/share/crypto-policies/*/*
node=localhost type=AVC msg=audit(1661344395.351:395): avc: denied { getattr } for pid=1014 comm="chronyd" path="/usr/share/crypto-policies/FIPS/gnutls.txt" dev="dm-0" ino=402142 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1661344395.351:396): avc: denied { read } for pid=1014 comm="chronyd" name="gnutls.txt" dev="dm-0" ino=402142 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1
node=localhost type=AVC msg=audit(1661344395.351:396): avc: denied { open } for pid=1014 comm="chronyd" path="/usr/share/crypto-policies/FIPS/gnutls.txt" dev="dm-0" ino=402142 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=1
Signed-off-by: Dave Sugar <dsugar100@gmail.com>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
| -rw-r--r-- | policy/modules/services/chronyd.te | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/policy/modules/services/chronyd.te b/policy/modules/services/chronyd.te index 0cf41d3d0..aca9a63fd 100644 --- a/policy/modules/services/chronyd.te +++ b/policy/modules/services/chronyd.te @@ -104,6 +104,8 @@ corenet_udp_bind_chronyd_port(chronyd_t) dev_rw_realtime_clock(chronyd_t) +files_read_usr_files(chronyd_t) + auth_use_nsswitch(chronyd_t) logging_send_syslog_msg(chronyd_t) |