[gentoo-commits] proj/hardened-refpolicy:concord-dev commit in: policy/modules/system/

["Kenton Groombridge" <concord@gentoo.org>]

commit:     d50193d70d6d2620c82c112a534d36a6ff06e6ea
Author:     Dave Sugar <dsugar100 <AT> gmail <DOT> com>
AuthorDate: Fri Aug 26 12:45:38 2022 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Sat Sep  3 19:07:50 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=d50193d7

systemd: systemd-update-done fix startup issue

Seeing error:

Failed to initalize SELinux labeling handle: No such file or directory

but no denials.  With strace (and looking at source) found it is
opening /etc/selinux/config

openat(AT_FDCWD, "/etc/selinux/config", O_RDONLY|O_CLOEXEC) = 3

but that was dontaudited.

allow systemd_update_done_t file_type:filesystem getattr;
allow systemd_update_done_t selinux_config_t:dir { getattr open search };
dontaudit systemd_update_done_t selinux_config_t:dir { getattr open search };
dontaudit systemd_update_done_t selinux_config_t:file { getattr ioctl lock open read };

These changes fix the issue

Signed-off-by: Dave Sugar <dsugar100 <AT> gmail.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/system/systemd.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 2dc8b901..1eb35aa4 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1752,6 +1752,7 @@ kernel_read_kernel_sysctls(systemd_update_done_t)
 
 selinux_use_status_page(systemd_update_done_t)
 
+seutil_read_config(systemd_update_done_t)
 seutil_read_file_contexts(systemd_update_done_t)
 
 systemd_log_parse_environment(systemd_update_done_t)