fs_rw_tmpfs_files(fwupd_t)

fs_rw_tmpfs_files(fwupd_t)

[Russell Coker]

The below ausearch output is from a system running Debian/Trixie (the current 
stable release) with kernel 6.12.88+deb13-amd64.  The same thing happens with 
Debian/Unstable and kernel 7.0.10+deb14-amd64 but I expect people here are 
more interested in results from stable releases.

What would this be about?

type=PROCTITLE msg=audit(06/12/26 23:31:50.829:3771572) : proctitle=/usr/bin/
fwupdmgr refresh 
type=SYSCALL msg=audit(06/12/26 23:31:50.829:3771572) : arch=x86_64 
syscall=write success=no exit=EACCES(Permission denied) a0=0xb 
a1=0x7fc07c06f010 a2=0x1c817c a3=0x0 items=0 ppid=1 pid=160767 auid=unset 
uid=fwupd-refresh gid=fwupd-refresh euid=fwupd-refresh suid=fwupd-refresh 
fsuid=fwupd-refresh egid=fwupd-refresh sgid=fwupd-refresh fsgid=fwupd-refresh 
tty=(none) ses=unset comm=fwupdmgr exe=/usr/bin/fwupdmgr 
subj=system_u:system_r:fwupd_t:s0 key=(null) 
type=AVC msg=audit(06/12/26 23:31:50.829:3771572) : avc:  denied  { write } 
for  pid=160767 comm=fwupdmgr path=/memfd:fwupd (deleted) dev="tmpfs" 
ino=575756 scontext=system_u:system_r:fwupd_t:s0 
tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0 

The command "sesearch -A -s fwupd_t -t tmpfs_t -c file" gives no output, so 
fwupd_t shouldn't be able to create a file of that type.

What do you think is going on here?  Is the kernel creating it with the 
default context for the tmpfs filesystem and then passing it to fwupd?


I also see this from some other things such as the KDE screensaver:

type=PROCTITLE msg=audit(06/13/26 00:16:02.972:18192) : proctitle=/usr/lib/
x86_64-linux-gnu/libexec/kscreenlocker_greet --graceTime 5000 --ksldfd 74 
type=SYSCALL msg=audit(06/13/26 00:16:02.972:18192) : arch=x86_64 
syscall=ftruncate success=no exit=EACCES(Permission denied) a0=0x1f a1=0x1000 
a2=0x5 a3=0x7ffe1a5320e0 items=0 ppid=22905 pid=23368 auid=tv uid=tv gid=tv 
euid=tv suid=tv fsuid=tv egid=tv sgid=tv fsgid=tv tty=(none) ses=265 
comm=kscreenlocker_g exe=/usr/lib/x86_64-linux-gnu/libexec/kscreenlocker_greet 
subj=user_u:user_r:xscreensaver_t:s0 key=(null) 
type=AVC msg=audit(06/13/26 00:16:02.972:18192) : avc:  denied  { write } for  
pid=23368 comm=kscreenlocker_g name=memfd:unknown-usage:QtQml dev="tmpfs" 
ino=5250 scontext=user_u:user_r:xscreensaver_t:s0 
tcontext=user_u:object_r:tmpfs_t:s0 tclass=file permissive=0 

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

Re: fs_rw_tmpfs_files(fwupd_t)

[Christopher J. PeBenito]

On 6/12/26 10:27 AM, Russell Coker wrote:
> The below ausearch output is from a system running Debian/Trixie (the current
> stable release) with kernel 6.12.88+deb13-amd64.  The same thing happens with
> Debian/Unstable and kernel 7.0.10+deb14-amd64 but I expect people here are
> more interested in results from stable releases.
>
> What would this be about?
>   
> for  pid=160767 comm=fwupdmgr path=/memfd:fwupd (deleted) dev="tmpfs"
> ino=575756 scontext=system_u:system_r:fwupd_t:s0
> tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0

This is from a memfd. See memfd_create(2). It uses a tmpfs shm segment 
to back the anonymous inode. A fs_tmpfs_filetrans() will work for the 
domain that creates the memfd.

See https://github.com/SELinuxProject/refpolicy/pull/1141 for a recent 
merge for a memfd.

-- 
Chris PeBenito

Re: fs_rw_tmpfs_files(fwupd_t)

[Russell Coker]

On Saturday, 13 June 2026 01:15:33 AEST Sugar, David wrote:
> The file in this case is a memfd file (created with memfd_create).  You CAN
> transition this from tmpfs_t to a private type (i.e. fwupd_tmpfs_t).  I
> just dealt with something like this for fapolicyd:
> https://github.com/SELinuxProject/refpolicy/pull/1141  Though I never saw
> denials for the create, the transition will work.

Thanks for the information.

This seems like a kernel bug.  The domains in question aren't permitted to 
create tmpfs_t objects but the domains in question can create them anyway.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/