Skip to content

Commit ad83bfc

Browse files
rfrohlrfrohl
committed
Allow wireguard to setup DNS (bsc#1243148)
type=AVC msg=audit(..): avc: denied { getattr } for pid=1501 comm="wg-quick" path="/usr/bin/umount" dev="vda2" ino=352325 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mo unt_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { execute } for pid=1501 comm="wg-quick" name="umount" dev="vda2" ino=352325 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mount_exec_ t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { read } for pid=1501 comm="wg-quick" name="umount" dev="vda2" ino=352325 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mount_exec_t:s 0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { open } for pid=1550 comm="wg-quick" path="/usr/bin/umount" dev="vda2" ino=352325 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mount _exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { execute_no_trans } for pid=1550 comm="wg-quick" path="/usr/bin/umount" dev="vda2" ino=352325 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:ob ject_r:mount_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { read write } for pid=1550 comm="umount" name="mount" dev="tmpfs" ino=766 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mount_var_run _t:s0 tclass=dir permissive=1 type=AVC msg=audit(..): avc: denied { unmount } for pid=1550 comm="umount" scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 type=AVC msg=audit(..): avc: denied { mounton } for pid=1429 comm="unshare" path="/" dev="vda2" ino=256 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=1 type=AVC msg=audit(..): avc: denied { getattr } for pid=1429 comm="bash" path="/usr/bin/mount" dev="vda2" ino=352304 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mount_e xec_t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { execute } for pid=1429 comm="bash" name="mount" dev="vda2" ino=352304 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { read } for pid=1429 comm="bash" name="mount" dev="vda2" ino=352304 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tcl ass=file permissive=1 type=AVC msg=audit(..): avc: denied { open } for pid=1440 comm="bash" path="/usr/bin/mount" dev="vda2" ino=352304 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mount_exec _t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { execute_no_trans } for pid=1440 comm="bash" path="/usr/bin/mount" dev="vda2" ino=352304 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_ r:mount_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { read write } for pid=1441 comm="mount" name="mount" dev="tmpfs" ino=766 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mount_var_run_ t:s0 tclass=dir permissive=1 type=AVC msg=audit(..): avc: denied { mount } for pid=1441 comm="mount" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesys tem permissive=1 type=AVC msg=audit(..): avc: denied { mounton } for pid=1441 comm="mount" path="/dev/shm" dev="tmpfs" ino=1 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclas s=dir permissive=1 type=AVC msg=audit(..): avc: denied { create } for pid=1442 comm="bash" name="resolv.conf" scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive =1 type=AVC msg=audit(..): avc: denied { write open } for pid=1442 comm="bash" path="/dev/shm/resolv.conf" dev="tmpfs" ino=2 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:tm pfs_t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { getattr } for pid=1442 comm="cat" path="/dev/shm/resolv.conf" dev="tmpfs" ino=2 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:tmpfs_ t:s0 tclass=file permissive=1 dontaudit and fs_tmpfs_filetrans(): type=AVC msg=audit(..): avc: denied { write } for pid=1443 comm="chcon" name="context" dev="selinuxfs" ino=5 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:security_t:s0 t type=AVC msg=audit(..): avc: denied { check_context } for pid=1443 comm="chcon" scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1 type=AVC msg=audit(..): avc: denied { relabelfrom } for pid=1443 comm="chcon" name="resolv.conf" dev="tmpfs" ino=2 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:tmpfs_t:s 0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { relabelto } for pid=1443 comm="chcon" name="resolv.conf" dev="tmpfs" ino=2 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:net_conf_t: s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { execute } for pid=1444 comm="bash" name="mount" dev="vda2" ino=352304 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { read open } for pid=1444 comm="bash" path="/usr/bin/mount" dev="vda2" ino=352304 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:mount _exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { execute_no_trans } for pid=1444 comm="bash" path="/usr/bin/mount" dev="vda2" ino=352304 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_ r:mount_exec_t:s0 tclass=file permissive=1 type=AVC msg=audit(..): avc: denied { mounton } for pid=1429 comm="mount" path="/etc/resolv.conf" dev="vda2" ino=372219 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:net_ conf_t:s0 tclass=file permissive=1 storage_rw_fixed_disk_blk_dev(): type=AVC msg=audit(1754315767.202:373): avc: denied { getattr } for pid=5254 comm="mount" path="/dev/dm-0" dev="devtmpfs" ino=402 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=0 sysnet_create_config(wireguard_t): type=AVC msg=audit(1754392427.618:2593): avc: denied { create } for pid=40463 comm="bash" name="resolv.conf" scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file permissive=0 sysnet_write_config(wireguard_t): type=AVC msg=audit(1754392611.632:2598): avc: denied { write } for pid=40584 comm="bash" path="/dev/shm/resolv.conf" dev="tmpfs" ino=2 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file permissive=0 type=AVC msg=audit(1754392611.632:2599): avc: denied { write } for pid=40584 comm="bash" name="resolv.conf" dev="tmpfs" ino=2 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:net_conf_t:s0 tclass=file permissive=0 XXX: not resolved yet type=AVC msg=audit(..): avc: denied { sys_admin } for pid=7635 comm="umount" capability=21 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:system_r:wireguard_t:s0 tclass=capability permissive=0 type=AVC msg=audit(..): avc: denied { sys_admin } for pid=7699 comm="unshare" capability=21 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:system_r:wireguard_t:s0 tclass=capabilit y permissive=0
1 parent 3237654 commit ad83bfc

File tree

3 files changed

+90
-0
lines changed

3 files changed

+90
-0
lines changed

‎policy/modules/contrib/wireguard.te‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,42 @@ domain_use_interactive_fds(wireguard_t)
4141

4242
files_read_etc_files(wireguard_t)
4343

44+
# XXX: new DNS stuff
45+
allow wireguard_t self:capability sys_admin;
46+
47+
sysnet_mount_file(wireguard_t)
48+
#allow wireguard_t net_conf_t:file mounton;
49+
50+
# use fs_tmpfs_filetrans() instead of chcon on resolv.conf
51+
52+
# XXX: new interface below
53+
sysnet_dontaudit_file_relabelto(wireguard_t)
54+
#dontaudit wireguard_t net_conf_t:file { relabelto };
55+
56+
#dontaudit wireguard_t tmpfs_t:file { relabelfrom };
57+
# XXX: open, no interface yet
58+
59+
selinux_dontaudit_validate_context(wireguard_t)
60+
#dontaudit wireguard_t security_t:security check_context;
61+
#dontaudit wireguard_t security_t:file { read write };
62+
63+
sysnet_create_config(wireguard_t)
64+
sysnet_write_config(wireguard_t)
65+
66+
fs_tmpfs_filetrans(wireguard_t, net_conf_t, file, "resolv.conf")
67+
68+
fs_all_mount_fs_perms_tmpfs(wireguard_t)
69+
fs_mounton_tmpfs(wireguard_t)
70+
fs_manage_ramfs_files(wireguard_t)
71+
storage_rw_fixed_disk_blk_dev(wireguard_t)
72+
73+
optional_policy(`
74+
mount_exec(wireguard_t)
75+
mount_manage_pid_files(wireguard_t)
76+
')
77+
78+
files_mounton_rootfs(wireguard_t)
79+
4480
optional_policy(`
4581
auth_read_passwd(wireguard_t)
4682
')

‎policy/modules/kernel/filesystem.if‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5772,6 +5772,24 @@ interface(`fs_dontaudit_getattr_tmpfs_dirs',`
57725772
dontaudit $1 tmpfs_t:dir getattr;
57735773
')
57745774

5775+
########################################
5776+
## <summary>
5777+
## Do not audit relabelfrom attempts on files.
5778+
## </summary>
5779+
## <param name="domain">
5780+
## <summary>
5781+
## Domain to not audit.
5782+
## </summary>
5783+
## </param>
5784+
#
5785+
interface(`fs_dontaudit_relabelfrom_tmpfs_files',`
5786+
gen_require(`
5787+
type tmpfs_t;
5788+
')
5789+
5790+
dontaudit $1 tmpfs_t:file relabelfrom;
5791+
')
5792+
57755793
########################################
57765794
## <summary>
57775795
## Set the attributes of tmpfs directories.

‎policy/modules/system/sysnetwork.if‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1316,3 +1316,39 @@ interface(`sysnet_filetrans_cloud_net_conf',`
13161316

13171317
files_pid_filetrans($1, net_conf_t, dir, "cloud-init")
13181318
')
1319+
1320+
#######################################
1321+
## <summary>
1322+
## Dontaudit relabelto network config files.
1323+
## </summary>
1324+
## <param name="domain">
1325+
## <summary>
1326+
## Domain allowed access.
1327+
## </summary>
1328+
## </param>
1329+
#
1330+
interface(`sysnet_dontaudit_file_relabelto',`
1331+
gen_require(`
1332+
type net_conf_t;
1333+
')
1334+
1335+
dontaudit $1 net_conf_t:file { relabelto };
1336+
')
1337+
1338+
#######################################
1339+
## <summary>
1340+
## Mount network config files.
1341+
## </summary>
1342+
## <param name="domain">
1343+
## <summary>
1344+
## Domain allowed access.
1345+
## </summary>
1346+
## </param>
1347+
#
1348+
interface(`sysnet_mount_file',`
1349+
gen_require(`
1350+
type net_conf_t;
1351+
')
1352+
1353+
allow $1 net_conf_t:file mounton;
1354+
')

0 commit comments

Comments
 (0)