commit: 6a9ade8f0070fb55b5e24befa2501644b412fed2 Author: Dave Sugar <dsugar <AT> tresys <DOT> com> AuthorDate: Mon Dec 7 16:09:15 2020 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Sun Jan 10 21:52:17 2021 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=6a9ade8f
Allow systemd-modules-load to search kernel keys I was seeing the following errors from systemd-modules-load without this search permission. Dec 7 14:36:19 systemd-modules-load: Failed to insert 'nf_conntrack_ftp': Required key not available Dec 7 14:36:19 kernel: Request for unknown module key 'Red Hat Enterprise Linux kernel signing key: 3ffb026dadef6e0bc404752a7e7c29095a68eab7' err -13 Dec 7 14:36:19 systemd: systemd-modules-load.service: main process exited, code=exited, status=1/FAILURE Dec 7 14:36:19 audispd: node=loacalhost type=PROCTITLE msg=audit(1607351779.441:3259): proctitle="/usr/lib/systemd/systemd-modules-load" Dec 7 14:36:19 systemd: Failed to start Load Kernel Modules. This is the denial: Dec 7 15:56:52 audispd: node=localhost type=AVC msg=audit(1607356612.877:3815): avc: denied { search } for pid=11715 comm="systemd-modules" scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=key permissive=1 Signed-off-by: Dave Sugar <dsugar <AT> tresys.com> Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> policy/modules/kernel/kernel.te | 1 + policy/modules/system/modutils.te | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te index 8693e800..d70f625b 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -512,6 +512,7 @@ if( ! secure_mode_insmod ) { # gt: there seems to be no trace of the above, at # least in kernel versions greater than 2.6.37... allow can_load_kernmodule self:capability sys_nice; + kernel_search_key(can_load_kernmodule) kernel_setsched(can_load_kernmodule) } diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te index e002e6e3..a7f8e42c 100644 --- a/policy/modules/system/modutils.te +++ b/policy/modules/system/modutils.te @@ -62,7 +62,6 @@ kernel_write_proc_files(kmod_t) kernel_mount_debugfs(kmod_t) kernel_mount_kvmfs(kmod_t) kernel_read_debugfs(kmod_t) -kernel_search_key(kmod_t) # Rules for /proc/sys/kernel/tainted kernel_read_kernel_sysctls(kmod_t) kernel_rw_kernel_sysctl(kmod_t)