Misthios/bootc-images
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

fedora-cosmic: ship SELinux policy for kanidm-unixd sockets
Build containers / fedora-cosmic (rawhide) (push) Failing after 50s
Details
Build containers / fedora-cosmic (44) (push) Successful in 11m3s
Details

Browse Source 
nss/pam consumers (sshd, the display manager, systemd-userdbd, polkit, ...)
were denied write access to /run/kanidm-unixd/* (var_run_t), so Kanidm users
could not be resolved or authenticated and logins failed with 'invalid user'.
Add the audit2allow-derived CIL and load it at build time (semodule noreload).
This commit is contained in:
Misthios
2026-09-27 18:49:12 +02:00
parent a5c6170ac0
commit f00f4340b7
2 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
images/fedora-cosmic/files/kanidm-unixd.cil
+21
View File
@@ -0,0 +1,21 @@
; Kanidm ships no SELinux policy. Without these allows, nss/pam consumers
; (sshd, the display manager, systemd-userdbd, ...) are denied write access to
; the kanidm-unixd sockets in /run/kanidm-unixd (labeled var_run_t), so Kanidm
; users cannot be resolved or authenticated and logins fail (sshd reports
; "invalid user"). This is the allow set produced by:
; grep avc: /var/log/audit/audit.log | audit2allow
(allow accountsd_t var_run_t (sock_file (write)))
(allow auditd_t var_run_t (sock_file (write)))
(allow chkpwd_t var_run_t (sock_file (write)))
(allow local_login_t var_run_t (sock_file (write)))
(allow policykit_t var_run_t (sock_file (write)))
(allow ssh_keygen_t var_run_t (sock_file (write)))
(allow sshd_auth_t var_run_t (sock_file (write)))
(allow sshd_keygen_t var_run_t (sock_file (write)))
(allow sshd_session_t var_run_t (sock_file (write)))
(allow sshd_t var_run_t (sock_file (write)))
(allow systemd_bootc_generator_t var_run_t (sock_file (write)))
(allow systemd_selinux_autorelabel_generator_t var_run_t (sock_file (write)))
(allow systemd_userdbd_t var_run_t (sock_file (write)))
(allow xdm_t var_run_t (sock_file (write)))
(allow init_t unconfined_service_t (unix_stream_socket (connectto)))