31 lines
1.2 KiB
Diff
31 lines
1.2 KiB
Diff
From f987783e67829394f4da7fe44d6b30bf22869bba Mon Sep 17 00:00:00 2001
|
|
From: Javier Martinez Canillas <javierm@redhat.com>
|
|
Date: Fri, 8 Mar 2019 12:44:16 +0100
|
|
Subject: [PATCH] selinux: allow fwupd to communicate with tpm2-abrmd
|
|
|
|
In Fedora, we have the following SELinux AVC error:
|
|
|
|
Mar 07 09:18:35 river audit[1078]: USER_AVC pid=1078 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.558 spid=8554 tpid=8550 scontext=system_u:system_r:tabrmd_t:s0 tcontext=system_u:system_r:fwupd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
|
|
|
|
Allow fwupd to chat with tpm2-abrmd over D-BUS.
|
|
|
|
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
|
---
|
|
selinux/tabrmd.te | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/selinux/tabrmd.te b/selinux/tabrmd.te
|
|
index 5f04fc4686b..a6326f659c5 100644
|
|
--- a/selinux/tabrmd.te
|
|
+++ b/selinux/tabrmd.te
|
|
@@ -18,5 +18,6 @@ optional_policy(`
|
|
dbus_stub()
|
|
dbus_system_domain(tabrmd_t, tabrmd_exec_t)
|
|
allow system_dbusd_t tabrmd_t:unix_stream_socket rw_stream_socket_perms;
|
|
+ fwupd_dbus_chat(tabrmd_t)
|
|
')
|
|
|
|
--
|
|
2.20.1
|
|
|