URL: https://github.com/freeipa/freeipa/pull/5994 Author: flo-renaud Title: #5994: selinux policy: allow custodia to access /proc/cpuinfo Action: opened
PR body: """ On aarch64, custodia creates AVC when accessing /proc/cpuinfo.
According to gcrypt manual (https://gnupg.org/documentation/manuals/gcrypt/Configuration.html), /proc/cpuinfo is used on ARM architecture to read the hardware capabilities of the CPU. This explains why the issue happens only on aarch64.
audit2allow suggests to add the following: allow ipa_custodia_t proc_t:file { getattr open read };
but this policy would be too broad. Instead, the patch is using the interface kernel_read_system_state.
Fixes: https://pagure.io/freeipa/issue/8972 Signed-off-by: Florence Blanc-Renaud flo@redhat.com """
To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5994/head:pr5994 git checkout pr5994
URL: https://github.com/freeipa/freeipa/pull/5994 Author: flo-renaud Title: #5994: selinux policy: allow custodia to access /proc/cpuinfo Action: closed
To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5994/head:pr5994 git checkout pr5994
freeipa-devel@lists.fedorahosted.org