Make setfiles be able to send audit messages.
PATCH 1/1 Make setfiles be able to send audit messages.
From: Roy.Li <[email protected]>
When audit subsystem is enabled, and setfiles works from root dir, setfiles would send the AUDIT_FS_RELABEL information to audit system, If no permission to send the information to audit by netlink, setfiles would return error.
The test cases to reproduce this defect:
=> restorecon -R / => echo $? 255 =>
--- policy/modules/system/selinuxutil.te | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)
policy/modules/system/selinuxutil.te +2 -0
@@ -557,6 +557,8 @@ init_use_script_fds(setfiles_t) init_use_script_ptys(setfiles_t) init_exec_script_files(setfiles_t) +logging_send_audit_msgs(setfiles_t) + logging_send_syslog_msg(setfiles_t) miscfiles_read_localization(setfiles_t)
Signature · 1 line
1.6.3.1
PATCH 1/1 Make setfiles be able to send audit messages.
Quoted 23 lines · rongqing.li at windriver.com
From: Roy.Li <[email protected]>
When audit subsystem is enabled, and setfiles works from root dir, setfiles would send the
AUDIT_FS_RELABELinformation to audit system, If no permission to send the information to audit by netlink, setfiles would return error.The test cases to reproduce this defect:
=> restorecon -R / => echo $? 255 =>Signed-off-by Roy.Li <[email protected]>--- policy/modules/system/selinuxutil.te | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)policy/modules/system/selinuxutil.te +0
-0
policy/modules/system/selinuxutil.te init_use_script_fds(setfiles_t) · line 564
Quoted 8 lines
policy/modules/system/selinuxutil.te +2
-0@@ -557,6 +557,8 @@ init_use_script_fds(setfiles_t) init_use_script_ptys(setfiles_t) init_exec_script_files(setfiles_t) +logging_send_audit_msgs(setfiles_t) + logging_send_syslog_msg(setfiles_t) miscfiles_read_localization(setfiles_t)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com