Skip to content

Commit

Permalink
Allow key.dns_resolve create and use unix datagram socket
Browse files Browse the repository at this point in the history
The commit addresses the following AVC denial:
type=AVC msg=audit(1691747044.496:582): avc:  denied  { create } for  pid=95403 comm="key.dns_resolve" scontext=system_u:system_r:keyutils_dns_resolver_t:s0 tcontext=system_u:system_r:keyutils_dns_resolver_t:s0 tclass=unix_dgram_socket permissive=0

Resolves: rhbz#2231341
  • Loading branch information
zpytela committed Aug 11, 2023
1 parent 9677d3f commit d3f23e0
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions policy/modules/contrib/keyutils.te
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ domtrans_pattern(keyutils_request_t, keyutils_dns_resolver_exec_t, keyutils_dns_

allow keyutils_dns_resolver_t self:netlink_route_socket r_netlink_socket_perms;
allow keyutils_dns_resolver_t self:udp_socket create_socket_perms;
allow keyutils_dns_resolver_t self:unix_dgram_socket create_socket_perms;

kernel_read_key(keyutils_dns_resolver_t)
kernel_view_key(keyutils_dns_resolver_t)
Expand Down

0 comments on commit d3f23e0

Please sign in to comment.