Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Boolean: Allow virt_qemu_ga create ssh directory
Add interface ssh_create_home_dirs to allow domain to create .ssh directory and set attributes. Allow virt_qemu_ga create ssh directory in tunable boolean SSH key could be added to VM, but the .ssh directory cannot be created by VM after creating new user. Addresses the following denial: type=PROCTITLE msg=audit(07/19/2023 10:39:00.319:191) : proctitle=/usr/bin/qemu-ga --method=virtio-serial --path=/dev/virtio-ports/org.qemu.guest_agent.0 --block-rpcs=guest-file-open,guest-file- type=SYSCALL msg=audit(07/19/2023 10:39:00.319:191) : arch=x86_64 syscall=mkdir success=no exit=EACCES(Permission denied) a0=0x565274901da0 a1=0700 a2=0x0 a3=0x0 items=0 ppid=1 pid=1050 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=qemu-ga exe=/usr/bin/qemu-ga subj=system_u:system_r:virt_qemu_ga_t:s0 key=(null) type=AVC msg=audit(07/19/2023 10:39:00.319:191) : avc: denied { create } for pid=1050 comm=qemu-ga name=.ssh scontext=system_u:system_r:virt_qemu_ga_t:s0 tcontext=system_u:object_r:ssh_home_t:s0 tclass=dir permissive=0 Resolves: rhbz#2181402
- Loading branch information