Re: systemd and dontaudit

[Russell Coker <russell@coker.com.au>]

On Wednesday, 23 July 2025 23:39:42 AEST Dominick Grift wrote:
> > It only happened repeatedly on one of my systems.  I think that triggering
> > that particular condition required multiple settings, so just not allowing
> > statfs isn't necessarily enough, some other combination of things allowed
> > and denied seemed necessary to get it into that state. The one system
> > that had this had it persist across reboots but other systems never had
> > it.  I had seen it briefly happen on other systems but a reboot fixed it.
> > 
> > I didn't put as much effort into investigating this as I might have
> > because
> > the access in question is fairly innocuous.
> 
> I suspect this is triggered by libcap-ng's init function:
> https://github.com/stevegrubb/libcap-ng/blob/master/src/cap-ng.c#L236

But it works most of the time while it appears that all of the systemd 
programs (most of which are in domains which dontaudit that) work.  Also in 
the case where there was a problem it happened AFTER the program had 
initialised, so the program worked for some tasks but not all and the init of 
libcapng had already happened (that's from load time right?).

That said, the fact that a common shared library expects this is a good reason 
to allow it.  Also the fact that systemd programs seem to drag in heaps of 
shared libraries at load time suggests that even if we can get it working now 
we are likely to run into a variation of the problem on another library later 
on.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/