Proxmox-Port/swtpm
1
0
Fork 0
mirror of https://github.com/stefanberger/swtpm.git synced 2026-08-11 12:18:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

selinux: Add rule for logging to svirt_image_t labeled files from swtpm_t

Browse Source 
I was able to recreate the issue on one of my machines where swtpm_t
was trying to append to the log labeled with svirt_image_t. On another
machine this combination of labels does not seem to cause a problem.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2306817
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2024-09-30 17:29:11 -04:00 committed by Stefan Berger
parent aa78a302ec
commit 2d4a4c57cc
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/selinux/swtpm.te
View File

@ -7,6 +7,7 @@ policy_module(swtpm, 1.0.0)
require {
type qemu_var_run_t;
type svirt_image_t;
type var_log_t;
type virt_var_lib_t;
type virtqemud_t;
@ -33,6 +34,7 @@ allow swtpm_t virt_var_lib_t:dir { add_name remove_name write };
allow swtpm_t virt_var_lib_t:file { create rename setattr unlink write };
allow swtpm_t virtqemud_t:unix_stream_socket { read write getattr };
allow swtpm_t virtqemud_tmp_t:file { open write };
allow swtpm_t svirt_image_t:file { open write }; # BZ2306817
domain_use_interactive_fds(swtpm_t)