tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

selinux - allow dnsmasq to getattr on fifos

Browse source 
This is presumably libc isatty detection on stdin/out/err.
Either way - allowing it is harmless.

This fixes:
  type=1400 audit(): avc: denied { getattr } for comm="dnsmasq" path="pipe:[38315]" dev="pipefs" ino=38315 scontext=u:r:dnsmasq:s0 tcontext=u:r:netd:s0 tclass=fifo_file permissive=0

Test: built and observed no more avc denials on crosshatch

Bug: 77868789
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ieab51aeb67ebb85b6c778410ba96963612277ae4
This commit is contained in:
Maciej Żenczykowski 2019-04-08 21:16:28 -07:00
parent c165185e05
commit afa10f7223
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
public/dnsmasq.te
View file

@ -15,7 +15,7 @@ allow dnsmasq dhcp_data_file:file create_file_perms;
# Inherit and use open files from netd.
allow dnsmasq netd:fd use;
allow dnsmasq netd:fifo_file { read write };
allow dnsmasq netd:fifo_file { getattr read write };
# TODO: Investigate whether these inherited sockets should be closed on exec.
allow dnsmasq netd:netlink_kobject_uevent_socket { read write };
allow dnsmasq netd:netlink_nflog_socket { read write };