Misthios
f00f4340b7
nss/pam consumers (sshd, the display manager, systemd-userdbd, polkit, ...) were denied write access to /run/kanidm-unixd/* (var_run_t), so Kanidm users could not be resolved or authenticated and logins failed with 'invalid user'. Add the audit2allow-derived CIL and load it at build time (semodule noreload).
22 lines
1.2 KiB
Plaintext
22 lines
1.2 KiB
Plaintext
; Kanidm ships no SELinux policy. Without these allows, nss/pam consumers
|
|
; (sshd, the display manager, systemd-userdbd, ...) are denied write access to
|
|
; the kanidm-unixd sockets in /run/kanidm-unixd (labeled var_run_t), so Kanidm
|
|
; users cannot be resolved or authenticated and logins fail (sshd reports
|
|
; "invalid user"). This is the allow set produced by:
|
|
; grep avc: /var/log/audit/audit.log | audit2allow
|
|
(allow accountsd_t var_run_t (sock_file (write)))
|
|
(allow auditd_t var_run_t (sock_file (write)))
|
|
(allow chkpwd_t var_run_t (sock_file (write)))
|
|
(allow local_login_t var_run_t (sock_file (write)))
|
|
(allow policykit_t var_run_t (sock_file (write)))
|
|
(allow ssh_keygen_t var_run_t (sock_file (write)))
|
|
(allow sshd_auth_t var_run_t (sock_file (write)))
|
|
(allow sshd_keygen_t var_run_t (sock_file (write)))
|
|
(allow sshd_session_t var_run_t (sock_file (write)))
|
|
(allow sshd_t var_run_t (sock_file (write)))
|
|
(allow systemd_bootc_generator_t var_run_t (sock_file (write)))
|
|
(allow systemd_selinux_autorelabel_generator_t var_run_t (sock_file (write)))
|
|
(allow systemd_userdbd_t var_run_t (sock_file (write)))
|
|
(allow xdm_t var_run_t (sock_file (write)))
|
|
(allow init_t unconfined_service_t (unix_stream_socket (connectto)))
|