-
Bug
-
Resolution: Duplicate
-
Normal
-
None
-
rhel-9.5
-
None
-
None
-
Moderate
-
rhel-sst-security-selinux
-
ssg_security
-
None
-
False
-
-
No
-
Red Hat Enterprise Linux
-
None
-
None
-
None
-
Unspecified Release Note Type - Unknown
-
None
What were you trying to do that didn't work?
Executing timedatectl from a service running as initrc_t fails in timeout and produces a USER_AVC due to missing the (well-known) capability for DBUS to answer to requests:
type=USER_AVC msg=audit(02/20/2024 14:03:16.615:646) : pid=795 uid=dbus auid=unset ses=unset subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.116 spid=31737 tpid=31748 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus permissive=0 exe=/usr/bin/dbus-daemon sauid=dbus hostname=? addr=? terminal=?'
Please provide the package NVR for which bug is seen:
selinux-policy-3.14.3-128.el8_9.1.noarch
How reproducible:
Always
Steps to reproduce
- Start timedatectl in appropriate context
# systemd-run /bin/sh -c "timedatectl"
Expected results
Works
Actual results
Fails in timeout + USER_AVC
- duplicates
-
RHEL-35782 Ensure dbus communication is allowed bidirectionally
- Closed