Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-71803

systemd v257 requires getattr access on nsfs files

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • selinux-policy-40.13.19-1.el10
    • No
    • Moderate
    • 1
    • rhel-security-selinux
    • ssg_security
    • 20
    • 1
    • QE ack
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • SELINUX 241127 - 241218
    • Hide

      systemd processes do no trigger any SELinux denials related to NSFS (namespace filesystem) after upgrading to the systemd version 257.

      Show
      systemd processes do no trigger any SELinux denials related to NSFS (namespace filesystem) after upgrading to the systemd version 257.
    • Pass
    • Manual
    • Release Note Not Required
    • None

      # rpm -q systemd selinux-policy
      systemd-257-1.el10.x86_64
      selinux-policy-40.13.13-1.el10.noarch

      # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts boot  
      ----
      type=PROCTITLE msg=audit(12/18/2024 17:09:58.218:38) : proctitle=/usr/lib/systemd/systemd-logind  
      type=SYSCALL msg=audit(12/18/2024 17:09:58.218:38) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x7ffc607ad840 a2=0x7ffc607ad870 a3=0x0 items=0 ppid=1 pid=671 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null)  
      type=AVC msg=audit(12/18/2024 17:09:58.218:38) : avc:  denied  { getattr } for  pid=671 comm=systemd-logind path=cgroup:[4026531835] dev="nsfs" ino=4026531835 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=0

              rhn-support-zpytela Zdenek Pytela
              rhn-support-zpytela Zdenek Pytela
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: