From: Russell Coker <russell@coker.com.au>
To: selinux-refpolicy@vger.kernel.org
Subject: denied { allowed }
Date: Sat, 23 May 2026 11:45:57 +1000 [thread overview]
Message-ID: <12900249.O9o76ZdvQC@xev> (raw)
Why do we have a permission named "allowed"? The syscall is io_uring_setup so
surely "setup" would be a reasonable permission name.
"allowed" gives no indication of what the permission is actually for and
results in confusing log entries and policy.
/var/log/audit/audit.log.1:type=AVC msg=audit(1779420151.752:71961): avc:
denied { allowed } for pid=866175 comm="dig"
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=io_uring
permissive=0
/var/log/audit/audit.log.1:type=SYSCALL msg=audit(1779420151.752:71961):
arch=c000003e syscall=425 success=no exit=-13 a0=100 a1=7ffc066fd1f0 a2=0 a3=c
items=0 ppid=866150 pid=866175 auid=1027 uid=1027 gid=1028 euid=1027 suid=1027
fsuid=1027 egid=1028 sgid=1028 fsgid=1028 tty=pts1 ses=2320 comm="dig" exe="/
usr/bin/dig" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
key=(null)ARCH=x86_64 SYSCALL=io_uring_setup AUID="yifei" UID="yifei"
GID="yifei" EUID="yifei" SUID="yifei" FSUID="yifei" EGID="yifei" SGID="yifei"
FSGID="yifei"
--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/
next reply other threads:[~2026-05-23 1:52 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-23 1:45 Russell Coker [this message]
2026-05-23 23:14 ` denied { allowed } Christian Göttsche
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=12900249.O9o76ZdvQC@xev \
--to=russell@coker.com.au \
--cc=selinux-refpolicy@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.