pidfs

pidfs

[Russell Coker]

What's this new pidfs that seems to have just become visible in 6.11.10 or 
similar recent kernels?

https://lwn.net/Articles/714932/

The above article has some information about a previous iteration of it, 
apparently not a separate mountable filesystem but a part of /proc that can be 
mounted as part of a container.

I'm seeing the following audit entries about it, what should we do in policy 
about this?

type=AVC msg=audit(1733540968.538:31305): avc:  denied  { getattr } for  
pid=1465 comm="systemd" name="/" dev="pidfs" ino=1 
scontext=etbe:user_r:user_systemd_t:s0-s0:c0.c1023 
tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=0

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

Re: pidfs

[Chris PeBenito]

On 12/6/2024 10:22 PM, Russell Coker wrote:
> What's this new pidfs that seems to have just become visible in 6.11.10 or
> similar recent kernels?
> 
> https://lwn.net/Articles/714932/
> 
> The above article has some information about a previous iteration of it,
> apparently not a separate mountable filesystem but a part of /proc that can be
> mounted as part of a container.
> 
> I'm seeing the following audit entries about it, what should we do in policy
> about this?
> 
> type=AVC msg=audit(1733540968.538:31305): avc:  denied  { getattr } for
> pid=1465 comm="systemd" name="/" dev="pidfs" ino=1
> scontext=etbe:user_r:user_systemd_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=0

You should expect to see pidfds extensively with systemd processes, as 
the main systemd interfaces now use pidfds.

Right now the only option is to use a genfscon or task sid.  I'd have 
preferred to improve the labeling behavior, but no kernel devs have had 
a chance to address it.

See https://github.com/SELinuxProject/refpolicy/pull/762

--
Chris