From: Russell Coker <russell@coker.com.au>
To: Dominick Grift <dac.override@gmail.com>
Cc: "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
Subject: Re: systemd reboot
Date: Fri, 27 Mar 2020 22:52:20 +1100 [thread overview]
Message-ID: <2479184.xkgEG3NQo7@xev> (raw)
In-Reply-To: <20190714161619.GB29870@brutus.lan>
On Monday, 15 July 2019 2:16:19 AM AEDT Dominick Grift wrote:
> On Mon, Jul 15, 2019 at 01:10:48AM +1000, Russell Coker wrote:
> > # cat /lib/systemd/system/reboot.target
> > cat: /lib/systemd/system/reboot.target: Permission denied
> > # systemctl reboot
> > ... it reboots
> >
> > Should systemd be doing some sort of access check on reboot.target?
>
> I was wrong. It is doing an acccess check on reboot.target
>
> I tried it out here:
> https://www.youtube.com/watch?v=YUATkv6R6Ys&feature=youtu.be
Thanks for the pointer, I put in an auditallow rule and got the following when
user_t runs "systemctl reboot". It's doing the permission check on systemd-
logind.
Do you have any idea of where I should look for the cause of this?
type=USER_AVC msg=audit(1585309343.652:285): pid=1 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: granted { start }
for auid=n/a uid=0 gid=0 path="/lib/systemd/system/reboot.target" cmdline="/
lib/systemd/systemd-logind" scontext=system_u:system_r:systemd_logind_t:s0
tcontext=system_u:object_r:power_unit_t:s0 tclass=service exe="/usr/lib/
systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1585309343.660:287): pid=1 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: granted { start }
for auid=n/a uid=0 gid=0 path="/lib/systemd/system/reboot.target" cmdline="/
lib/systemd/systemd-logind" scontext=system_u:system_r:systemd_logind_t:s0
tcontext=system_u:object_r:power_unit_t:s0 tclass=service exe="/usr/lib/
systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/
prev parent reply other threads:[~2020-03-27 11:52 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-14 15:10 systemd reboot Russell Coker
2019-07-14 15:23 ` Dominick Grift
2019-07-14 16:16 ` Dominick Grift
2020-03-27 11:52 ` Russell Coker [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2479184.xkgEG3NQo7@xev \
--to=russell@coker.com.au \
--cc=dac.override@gmail.com \
--cc=selinux-refpolicy@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.