32 lines
1.1 KiB
Diff
32 lines
1.1 KiB
Diff
From 9379c57eeacdcf80e82f5ef4fd88d8def71887d9 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@cryptomilk.org>
|
|
Date: Fri, 26 Jun 2026 12:25:28 +0200
|
|
Subject: [PATCH] fix(selinux): allow certmonger_t to search sysctl_net_t
|
|
directories
|
|
|
|
Python's socket/network initialization reads /proc/sys/net, which is
|
|
labeled sysctl_net_t. Without the search permission certmonger denies
|
|
the openat syscall with EACCES under enforcing SELinux.
|
|
---
|
|
selinux/cepces.te | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/selinux/cepces.te b/selinux/cepces.te
|
|
index 63da747..a894888 100644
|
|
--- a/selinux/cepces.te
|
|
+++ b/selinux/cepces.te
|
|
@@ -4,6 +4,7 @@ require {
|
|
type certmonger_t;
|
|
type kernel_t;
|
|
type ldconfig_exec_t;
|
|
+ type sysctl_net_t;
|
|
}
|
|
|
|
type cepces_log_t;
|
|
@@ -13,4 +14,5 @@ allow certmonger_t cepces_log_t:dir { add_name search write };
|
|
allow certmonger_t cepces_log_t:file { create open };
|
|
|
|
allow certmonger_t kernel_t:system module_request;
|
|
+allow certmonger_t sysctl_net_t:dir search;
|
|
allow certmonger_t ldconfig_exec_t:file { read execute open execute_no_trans };
|