Skip to content

Commit

Permalink
Allow gnome-remote-desktop watch /etc directory
Browse files Browse the repository at this point in the history
The denial can be triggered by the following sequence:
grdctl --system vnc enable
grdctl --system rdp enable

The commit addresses the following AVC denial:
type=PROCTITLE msg=audit(10/23/2024 02:51:35.701:987) : proctitle=/usr/libexec/gnome-remote-desktop-daemon --system
type=PATH msg=audit(10/23/2024 02:51:35.701:987) : item=0 name=/etc/gnome-remote-desktop inode=276729 dev=fc:02 mode=dir,755 ouid=gnome-remote-desktop ogid=gnome-remote-desktop rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=SYSCALL msg=audit(10/23/2024 02:51:35.701:987) : arch=x86_64 syscall=inotify_add_watch success=yes exit=2 a0=0x3 a1=0x5620c104b9d0 a2=0x1002fce a3=0x5620c1003010 items=1 ppid=1 pid=3596 auid=unset uid=gnome-remote-desktop gid=gnome-remote-desktop euid=gnome-remote-desktop suid=gnome-remote-desktop fsuid=gnome-remote-desktop egid=gnome-remote-desktop sgid=gnome-remote-desktop fsgid=gnome-remote-desktop tty=(none) ses=unset comm=gnome-remote-de exe=/usr/libexec/gnome-remote-desktop-daemon subj=system_u:system_r:gnome_remote_desktop_t:s0 key=(null)
type=AVC msg=audit(10/23/2024 02:51:35.701:987) : avc:  denied  { watch } for  pid=3596 comm=gnome-remote-de path=/etc/gnome-remote-desktop dev="vda2" ino=276729 scontext=system_u:system_r:gnome_remote_desktop_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1

Resolves: rhbz#2321236
  • Loading branch information
zpytela committed Oct 24, 2024
1 parent d1d4957 commit fd1d996
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions policy/modules/contrib/gnome_remote_desktop.te
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ allow gnome_remote_desktop_t self:unix_dgram_socket create_socket_perms;
domain_use_interactive_fds(gnome_remote_desktop_t)

files_read_etc_files(gnome_remote_desktop_t)
files_watch_etc_dirs(gnome_remote_desktop_t)

corenet_tcp_bind_generic_node(gnome_remote_desktop_t)
dev_read_sysfs(gnome_remote_desktop_t)
Expand Down

0 comments on commit fd1d996

Please sign in to comment.