]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
scsi: target: Fix SELinux error when systemd-modules loads the target module
authorMaurizio Lombardi <mlombard@redhat.com>
Thu, 15 Feb 2024 14:39:43 +0000 (15:39 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 17 May 2024 10:02:15 +0000 (12:02 +0200)
commit2f35afac27735f8b8db23e753c4cdd6b8636ca75
treed6562fb4770ed297079312ae105161c25e4cae72
parent14e731533b395c8503545e4826392180632c24f2
scsi: target: Fix SELinux error when systemd-modules loads the target module

[ Upstream commit 97a54ef596c3fd24ec2b227ba8aaf2cf5415e779 ]

If the systemd-modules service loads the target module, the credentials of
that userspace process will be used to validate the access to the target db
directory.  SELinux will prevent it, reporting an error like the following:

kernel: audit: type=1400 audit(1676301082.205:4): avc: denied  { read }
for  pid=1020 comm="systemd-modules" name="target" dev="dm-3"
ino=4657583 scontext=system_u:system_r:systemd_modules_load_t:s0
tcontext=system_u:object_r:targetd_etc_rw_t:s0 tclass=dir permissive=0

Fix the error by using the kernel credentials to access the db directory

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Link: https://lore.kernel.org/r/20240215143944.847184-2-mlombard@redhat.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/target/target_core_configfs.c