URL:
https://github.com/freeipa/freeipa/pull/5994
Author: flo-renaud
Title: #5994: selinux policy: allow custodia to access /proc/cpuinfo
Action: opened
PR body:
"""
On aarch64, custodia creates AVC when accessing /proc/cpuinfo.
According to gcrypt manual
(
https://gnupg.org/documentation/manuals/gcrypt/Configuration.html),
/proc/cpuinfo is used on ARM architecture to read the hardware
capabilities of the CPU. This explains why the issue happens only
on aarch64.
audit2allow suggests to add the following:
allow ipa_custodia_t proc_t:file { getattr open read };
but this policy would be too broad. Instead, the patch is using
the interface kernel_read_system_state.
Fixes:
https://pagure.io/freeipa/issue/8972
Signed-off-by: Florence Blanc-Renaud <flo(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa
https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5994/head:pr5994
git checkout pr5994