diff mbox series

[meta-selinux,1/5] refpolicy: Added dontaudit on docker_t to manage /usr directory

Message ID IA3PR02MB11199D6520CA929CA400D06E4F151A@IA3PR02MB11199.namprd02.prod.outlook.com
State New
Headers show
Series [meta-selinux,1/5] refpolicy: Added dontaudit on docker_t to manage /usr directory | expand

Commit Message

Gargi Misra April 2, 2026, 6:56 a.m. UTC 
refpolicy: Added dontaudit on docker_t to manage /usr directory

avc:  denied  { add_name } for  pid=1154 comm="containerd" name="containerd" scontext=system_u:system_r:dockerd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=1
avc:  denied  { create } for  pid=1154 comm="containerd" name="containerd" scontext=system_u:system_r:dockerd_t:s0 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=1

Upstream-Status: Backport [refpolicy: Added dontaudit on docker_t to manage /usr directory * SELinuxProject/refpolicy@bd3c6e0<https://github.com/SELinuxProject/refpolicy/commit/bd3c6e00e87b08af23ea3fd50bfb76a3e7ba4c73>]
Signed-off-by: Gargi Misra <gmisra@qti.qualcomm.com>
---
policy/modules/kernel/files.if    | 18 ++++++++++++++++++
policy/modules/services/docker.te |  2 +-
2 files changed, 19 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index e55bf337e3..de77c0f090 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -5529,6 +5529,24 @@  interface(`files_delete_usr_dirs',`
               delete_dirs_pattern($1, usr_t, usr_t)
')
+########################################
+## <summary>
+##      Dontaudit Manage /usr directories.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`files_dontaudit_manage_usr_dirs',`
+        gen_require(`
+                type usr_t;
+        ')
+
+        dontaudit $1 usr_t:dir manage_dir_perms;
+')
+
########################################
## <summary>
##          Watch generic directories in /usr.
diff --git a/policy/modules/services/docker.te b/policy/modules/services/docker.te
index a23c21c8f6..f40713d121 100644
--- a/policy/modules/services/docker.te
+++ b/policy/modules/services/docker.te
@@ -47,7 +47,7 @@  container_runtime_named_socket_activation(dockerd_t)
# docker fails to start if /proc/kallsyms is unreadable,
# but only when btrfs support is disabled
files_read_kernel_symbol_table(dockerd_t)
-files_dontaudit_write_usr_dirs(dockerd_t)
+files_dontaudit_manage_usr_dirs(dockerd_t)
 kernel_relabelfrom_unlabeled_dirs(dockerd_t)
# docker wants to load binfmt_misc