Allow unconfined domains to use syslog capability
PATCH 1/1 Allow unconfined domains to use syslog capability
When an unconfined_t root user runs dmesg, the kernel complains with this message in its logs (when SELinux is in enforcing mode):
dmesg (16289): Attempt to access syslog with CAP_SYS_ADMIN but no CAP_SYSLOG (deprecated).
audit.log contains following AVC:
avc: denied { syslog } for pid=16289 comm="dmesg" capability=34 scontext=unconfined_u:unconfined_r:unconfined_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=capability2
--- policy/modules/system/unconfined.if | 1 + 1 file changed, 1 insertion(+)
policy/modules/system/unconfined.if +1 -0
@@ -20,6 +20,7 @@ interface(`unconfined_domain_noaudit',` # Use most Linux capabilities allow $1 self:capability ~sys_module; + allow $1 self:capability2 syslog; allow $1 self:fifo_file manage_fifo_file_perms; # Transition to myself, to make get_ordered_context_list happy.
Signature · 1 line
2.0.0
PATCH 1/1 Allow unconfined domains to use syslog capability
Quoted 20 lines · Nicolas Iooss
When an
unconfined_troot user runs dmesg, the kernel complains with this message in its logs (when SELinux is in enforcing mode):dmesg (16289): Attempt to access syslog with
CAP_SYS_ADMINbut noCAP_SYSLOG(deprecated).audit.log contains following AVC:
avc: denied { syslog } for pid=16289 comm="dmesg" capability=34 scontext=unconfined_u:unconfined_r:unconfined_t tcontext=unconfined_u:unconfined_r:unconfined_t tclass=capability2
--- policy/modules/system/unconfined.if | 1 + 1 file changed, 1 insertion(+)policy/modules/system/unconfined.if +0
-0
policy/modules/system/unconfined.if interface(`unconfined_domain_noaudit',` · line 26
Quoted 7 lines
policy/modules/system/unconfined.if +1
-0@@ -20,6 +20,7 @@ interface(`unconfined_domain_noaudit',` # Use most Linux capabilities allow $1 self:capability ~sys_module; + allow $1 self:capability2 syslog; allow $1 self:fifo_file manage_fifo_file_perms; # Transition to myself, to make get_ordered_context_list happy.
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com