fedora-selinux / selinux-policy

selinux-policy for Fedora is a large patch off the mainline
GNU General Public License v2.0
156 stars 157 forks source link

Allow timemaster write to sysfs files #2210

Closed zpytela closed 6 hours ago

zpytela commented 5 days ago

Timemaster has a new functionality to configure virtual clocks by writing to files in /sys.

The commit addresses the following AVC denials: type=AVC msg=audit(1710170769.424:453): avc: denied { read } for pid=18663 comm="timemaster" name="ptp0" dev="sysfs" ino=30545 scontext=system_u:system_r:timemaster_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=lnk_file permissive=1 type=AVC msg=audit(1710170769.424:453): avc: denied { write } for pid=18663 comm="timemaster" name="n_vclocks" dev="sysfs" ino=30557 scontext=system_u:system_r:timemaster_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1 type=AVC msg=audit(1710170769.441:457): avc: denied { read } for pid=19357 comm="timemaster" name="ptp0" dev="sysfs" ino=30541 scontext=system_u:system_r:timemaster_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=1

Resolves: RHEL-28777

packit-as-a-service[bot] commented 5 days ago

Cockpit tests failed for commit b6c34d59e9026f83099799d7816e5a0f5891a4a4. @martinpitt, @jelly, @mvollmer please check.

packit-as-a-service[bot] commented 5 days ago

Cockpit tests failed for commit e826e2f6551e69f313440e1a2b84e3592edbebef. @martinpitt, @jelly, @mvollmer please check.