From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.sws.net.au (smtp.sws.net.au [144.76.186.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B28672F2C45 for ; Wed, 23 Jul 2025 14:30:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=144.76.186.9 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1753281005; cv=none; b=K83SU7ugmFmR4nkVGniuIrf2fVFWaecz2mrBeh0douSRUrKj0omsAYccCQc865jaN1BGIirpW5b4dKPc917Z+2plE1g3T5NHUK+/+ChnM61ugaDVQXCrDGwlcc46xa7AayTQylCyNJB5Ukiz2qE7hus+8iJeUgEAA8SwSH83Vac= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1753281005; c=relaxed/simple; bh=zYUuOmrhh8615vO5ymmLr6kKfyaftF7zn/k8zji6RPE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=q7ncWSUGN9bO3Y2M4Wxkg16qwe0p5ge6PfZnb4mjjbNv426mk817tIQQ/Vb1+qj38VwO/Guw006IViYmFqXL3m4V4C66uPcA9y2mwZfdSfEcHBLnMkZQ+oFsuPrKguulEzdW849LjzB7PAOXq4dIJvY7hHvALsywJOCoefWrCCY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=coker.com.au; spf=pass smtp.mailfrom=coker.com.au; dkim=pass (1024-bit key) header.d=coker.com.au header.i=@coker.com.au header.b=S6/QK7TF; arc=none smtp.client-ip=144.76.186.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=coker.com.au Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=coker.com.au Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=coker.com.au header.i=@coker.com.au header.b="S6/QK7TF" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au; s=2008; t=1753281000; bh=w4rDV+Zcr8NWfyB816s7FVhTmtpnJuxsDX5w3ixoxAA=; l=1581; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S6/QK7TFUC0lbh7pHOa6m666aeQMsTOfx0GbvDgvqj5WuqhHUgv1sp/GcGvZSoMCU Oq5QQVJEWHKVUS8fKHkLJolQPZ630rliyM3o1BinfvYQ8LCwPdhcfP0oaYZhxQfmH7 w70Xw1NsReJMzL8izDELyywhqX6r88sNs4DGzqdw= Received: from liv.coker.com.au (n175-33-172-140.sun22.vic.optusnet.com.au [175.33.172.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) (Authenticated sender: russell@coker.com.au) by smtp.sws.net.au (Postfix) with ESMTPSA id 63B10FC45; Thu, 24 Jul 2025 00:29:59 +1000 (AEST) From: Russell Coker To: Dominick Grift Cc: SELinux Reference Policy mailing list , Chris PeBenito Subject: Re: systemd and dontaudit Date: Thu, 24 Jul 2025 00:29:54 +1000 Message-ID: <5056689.31r3eYUQgx@dojacat> In-Reply-To: <871pq758m9.fsf@defensec.nl> References: <13022276.O9o76ZdvQC@xev> <12737856.O9o76ZdvQC@dojacat> <871pq758m9.fsf@defensec.nl> Precedence: bulk X-Mailing-List: selinux-refpolicy@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="utf-8" On Wednesday, 23 July 2025 23:39:42 AEST Dominick Grift wrote: > > It only happened repeatedly on one of my systems. I think that triggering > > that particular condition required multiple settings, so just not allowing > > statfs isn't necessarily enough, some other combination of things allowed > > and denied seemed necessary to get it into that state. The one system > > that had this had it persist across reboots but other systems never had > > it. I had seen it briefly happen on other systems but a reboot fixed it. > > > > I didn't put as much effort into investigating this as I might have > > because > > the access in question is fairly innocuous. > > I suspect this is triggered by libcap-ng's init function: > https://github.com/stevegrubb/libcap-ng/blob/master/src/cap-ng.c#L236 But it works most of the time while it appears that all of the systemd programs (most of which are in domains which dontaudit that) work. Also in the case where there was a problem it happened AFTER the program had initialised, so the program worked for some tasks but not all and the init of libcapng had already happened (that's from load time right?). That said, the fact that a common shared library expects this is a good reason to allow it. Also the fact that systemd programs seem to drag in heaps of shared libraries at load time suggests that even if we can get it working now we are likely to run into a variation of the problem on another library later on. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/