Skip to content

Commit 3e340ad

Browse files
committed
Allow rasdaemon write to soft_offline_page
The commit addresses the following AVC denial: type=PROCTITLE msg=audit(04/09/2025 09:25:36.104:3309) : proctitle=/usr/sbin/rasdaemon -f -r type=PATH msg=audit(04/09/2025 09:25:36.104:3309) : item=0 name=/sys/devices/system/memory/soft_offline_page inode=41 dev=00:19 mode=file,200 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:sysfs_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=SYSCALL msg=audit(04/09/2025 09:25:36.104:3309) : arch=aarch64 syscall=faccessat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0xaaaacfbb7458 a2=W_OK a3=0x5 items=1 ppid=1 pid=195589 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rasdaemon exe=/usr/sbin/rasdaemon subj=system_u:system_r:rasdaemon_t:s0 key=(null) type=AVC msg=audit(04/09/2025 09:25:36.104:3309) : avc: denied { write } for pid=195589 comm=rasdaemon name=soft_offline_page dev="sysfs" ino=41 scontext=system_u:system_r:rasdaemon_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0 Resolves: RHEL-86926
1 parent a89951a commit 3e340ad

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

policy/modules/contrib/rasdaemon.te

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ dev_read_raw_memory(rasdaemon_t)
3434
dev_rw_sysfs(rasdaemon_t)
3535
dev_read_urand(rasdaemon_t)
3636
dev_rw_cpu_microcode(rasdaemon_t)
37+
dev_write_memory_offline_page(rasdaemon_t)
3738

3839
corecmd_exec_bin(rasdaemon_t)
3940

0 commit comments

Comments
 (0)