fs_rw_tmpfs_files(fwupd_t)

[Russell Coker <russell@coker.com.au>]

The below ausearch output is from a system running Debian/Trixie (the current 
stable release) with kernel 6.12.88+deb13-amd64.  The same thing happens with 
Debian/Unstable and kernel 7.0.10+deb14-amd64 but I expect people here are 
more interested in results from stable releases.

What would this be about?

type=PROCTITLE msg=audit(06/12/26 23:31:50.829:3771572) : proctitle=/usr/bin/
fwupdmgr refresh 
type=SYSCALL msg=audit(06/12/26 23:31:50.829:3771572) : arch=x86_64 
syscall=write success=no exit=EACCES(Permission denied) a0=0xb 
a1=0x7fc07c06f010 a2=0x1c817c a3=0x0 items=0 ppid=1 pid=160767 auid=unset 
uid=fwupd-refresh gid=fwupd-refresh euid=fwupd-refresh suid=fwupd-refresh 
fsuid=fwupd-refresh egid=fwupd-refresh sgid=fwupd-refresh fsgid=fwupd-refresh 
tty=(none) ses=unset comm=fwupdmgr exe=/usr/bin/fwupdmgr 
subj=system_u:system_r:fwupd_t:s0 key=(null) 
type=AVC msg=audit(06/12/26 23:31:50.829:3771572) : avc:  denied  { write } 
for  pid=160767 comm=fwupdmgr path=/memfd:fwupd (deleted) dev="tmpfs" 
ino=575756 scontext=system_u:system_r:fwupd_t:s0 
tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0 

The command "sesearch -A -s fwupd_t -t tmpfs_t -c file" gives no output, so 
fwupd_t shouldn't be able to create a file of that type.

What do you think is going on here?  Is the kernel creating it with the 
default context for the tmpfs filesystem and then passing it to fwupd?


I also see this from some other things such as the KDE screensaver:

type=PROCTITLE msg=audit(06/13/26 00:16:02.972:18192) : proctitle=/usr/lib/
x86_64-linux-gnu/libexec/kscreenlocker_greet --graceTime 5000 --ksldfd 74 
type=SYSCALL msg=audit(06/13/26 00:16:02.972:18192) : arch=x86_64 
syscall=ftruncate success=no exit=EACCES(Permission denied) a0=0x1f a1=0x1000 
a2=0x5 a3=0x7ffe1a5320e0 items=0 ppid=22905 pid=23368 auid=tv uid=tv gid=tv 
euid=tv suid=tv fsuid=tv egid=tv sgid=tv fsgid=tv tty=(none) ses=265 
comm=kscreenlocker_g exe=/usr/lib/x86_64-linux-gnu/libexec/kscreenlocker_greet 
subj=user_u:user_r:xscreensaver_t:s0 key=(null) 
type=AVC msg=audit(06/13/26 00:16:02.972:18192) : avc:  denied  { write } for  
pid=23368 comm=kscreenlocker_g name=memfd:unknown-usage:QtQml dev="tmpfs" 
ino=5250 scontext=user_u:user_r:xscreensaver_t:s0 
tcontext=user_u:object_r:tmpfs_t:s0 tclass=file permissive=0 

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/