commit: 087ca14923766efc87202a6b8a98f701105ff7a1 Author: Dave Sugar <dsugar100 <AT> gmail <DOT> com> AuthorDate: Wed Aug 24 14:32:45 2022 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Sat Sep 3 19:07:49 2022 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=087ca149
chronyd: Allow to read fips_enabled sysctl node=localhost type=AVC msg=audit(1661344394.902:355): avc: denied { search } for pid=1014 comm="chronyd" name="crypto" dev="proc" ino=10742 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir permissive=1 node=localhost type=AVC msg=audit(1661344394.902:355): avc: denied { read } for pid=1014 comm="chronyd" name="fips_enabled" dev="proc" ino=10743 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1661344394.902:355): avc: denied { open } for pid=1014 comm="chronyd" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=10743 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1661344394.902:356): avc: denied { getattr } for pid=1014 comm="chronyd" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=10743 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar <dsugar100 <AT> gmail.com> Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> policy/modules/services/chronyd.te | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/services/chronyd.te b/policy/modules/services/chronyd.te index 3354485c..0cf41d3d 100644 --- a/policy/modules/services/chronyd.te +++ b/policy/modules/services/chronyd.te @@ -81,6 +81,7 @@ manage_files_pattern(chronyd_t, chronyd_runtime_t, chronyd_runtime_t) manage_sock_files_pattern(chronyd_t, chronyd_runtime_t, chronyd_runtime_t) files_runtime_filetrans(chronyd_t, chronyd_runtime_t, { dir file sock_file }) +kernel_read_crypto_sysctls(chronyd_t) kernel_read_system_state(chronyd_t) kernel_read_network_state(chronyd_t)