Skip to content
Snippets Groups Projects
Commit 1d2ff869 authored by Nick Kralevich's avatar Nick Kralevich
Browse files

allow ueventd sysfs_type lnk_file

ueventd is allowed to change files and directories in /sys,
but not symbolic links. This is, at a minimum, causing the
following denial:

type=1400 audit(0.0:5): avc: denied { getattr } for comm="ueventd" path="/sys/devices/tegradc.0/driver" dev=sysfs ino=3386 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_tegradc:s0 tclass=lnk_file

Allow ueventd to modify labeling / attributes of symlinks.

Change-Id: If641a218e07ef479d1283f3171b2743f3956386d
parent b59dc27a
No related branches found
No related tags found
No related merge requests found
...@@ -10,7 +10,7 @@ allow ueventd self:capability { chown mknod net_admin setgid fsetid sys_rawio da ...@@ -10,7 +10,7 @@ allow ueventd self:capability { chown mknod net_admin setgid fsetid sys_rawio da
allow ueventd device:file create_file_perms; allow ueventd device:file create_file_perms;
allow ueventd device:chr_file rw_file_perms; allow ueventd device:chr_file rw_file_perms;
allow ueventd sysfs:file rw_file_perms; allow ueventd sysfs:file rw_file_perms;
allow ueventd sysfs_type:file { relabelfrom relabelto setattr getattr }; allow ueventd sysfs_type:{ file lnk_file } { relabelfrom relabelto setattr getattr };
allow ueventd sysfs_type:dir { relabelfrom relabelto setattr r_dir_perms }; allow ueventd sysfs_type:dir { relabelfrom relabelto setattr r_dir_perms };
allow ueventd sysfs_devices_system_cpu:file rw_file_perms; allow ueventd sysfs_devices_system_cpu:file rw_file_perms;
allow ueventd tmpfs:chr_file rw_file_perms; allow ueventd tmpfs:chr_file rw_file_perms;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment