Open DaanDeMeyer opened 2 months ago
@DaanDeMeyer The logs are trimmed. It would be even more helpful if there were audit logs with full auditing enabled. The above reproducer seems not to be complete, so I cannot investigate further.
@zpytela Apologies, these are the non-truncated logs, not with full auditing enabled though, I need to work on getting that enabled:
Jul 17 22:28:09 localhost audit[581]: AVC avc: denied { read } for pid=581 comm="agetty" name="agetty.autologin" dev="tmpfs" ino=2 scontext=system_u:system_r:getty_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=0
Jul 17 22:28:09 localhost audit[580]: AVC avc: denied { read } for pid=580 comm="agetty" name="agetty.autologin" dev="tmpfs" ino=3 scontext=system_u:system_r:getty_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=0
np, but can you add a functional reproducer or additional information - what path is the agetty.autologin file and which service creates it?
edit: now i see it's /run/credentials/serial-getty@hvc0.service/agetty.autologin and /run/credentials/serial-getty@hvc0.service/login.noauth reproducer would really be helpful
np, but can you add a functional reproducer or additional information - what path is the agetty.autologin file and which service creates it?
edit: now i see it's /run/credentials/serial-getty@hvc0.service/agetty.autologin and /run/credentials/serial-getty@hvc0.service/login.noauth reproducer would really be helpful
The mkosi reproducer is not sufficient? I have some local logic that allows building and installing new selinux-policy rpms from source into the mkosi image if that makes life easier. Though it's awfully slow because the spec calls make clean all over the place.
In selinux-policy specfile I see make clean once in the install phase which imho is correct.
In selinux-policy specfile I see make clean once in the install phase which imho is correct.
It probably is but it does make incremental builds using rpmbuild --build-in-place
impossible so one has to wait a very long time between builds.
@zpytela Anything I can do to make debugging this easier for you?
Yes, a simple reproducer. mkosi did not work for me for some reason. I'll give it another go.
In the latest util-linux release,
agetty
andlogin
will read systemd credentials to allow configuring their behavior. Reading the credentials should be allowed by the policy.To reproduce: