From f987783e67829394f4da7fe44d6b30bf22869bba Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Fri, 8 Mar 2019 12:44:16 +0100 Subject: [PATCH] selinux: allow fwupd to communicate with tpm2-abrmd In Fedora, we have the following SELinux AVC error: Mar 07 09:18:35 river audit[1078]: USER_AVC pid=1078 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.558 spid=8554 tpid=8550 scontext=system_u:system_r:tabrmd_t:s0 tcontext=system_u:system_r:fwupd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' Allow fwupd to chat with tpm2-abrmd over D-BUS. Signed-off-by: Javier Martinez Canillas --- selinux/tabrmd.te | 1 + 1 file changed, 1 insertion(+) diff --git a/selinux/tabrmd.te b/selinux/tabrmd.te index 5f04fc4686b..a6326f659c5 100644 --- a/selinux/tabrmd.te +++ b/selinux/tabrmd.te @@ -18,5 +18,6 @@ optional_policy(` dbus_stub() dbus_system_domain(tabrmd_t, tabrmd_exec_t) allow system_dbusd_t tabrmd_t:unix_stream_socket rw_stream_socket_perms; + fwupd_dbus_chat(tabrmd_t) ') -- 2.20.1