On Mon, 2021-07-26 at 22:02 +0000, Sam Morris via FreeIPA-users wrote:
I'm surprised setting your script to certmonger_unconfined_exec_t
didn't help - - can you try the ausearch command after doing so &
confirm that your script is now running in the certmonger_unconfined_t
domain?
I ran ausearch and didn't see anything new after setting the script to
the context you suggested. However, I did see a new denial:
type=USER_AVC msg=audit(1627342577.060:139): pid=978 uid=81
auid=4294967295 ses=4294967295
subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied
{ send_msg } for msgtype=error
error_name=org.freedesktop.systemd1.NoSuchDynamicUser dest=:1.46 spid=1
tpid=6439 scontext=system_u:system_r:init_t:s0
tcontext=system_u:system_r:certmonger_unconfined_t:s0 tclass=dbus
permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=?
terminal=?'UID="dbus" AUID="unset" SAUID="dbus"
Was caused by:
Missing type enforcement (TE) allow rule.
Running audit2allow on that says:
#============= init_t ==============
allow init_t certmonger_unconfined_t:dbus send_msg;
I don't know if doing that would introduce a security hole.
--
Ranbir