From a120ea8c25fc84dd41582431762e1c5770988f6c Mon Sep 17 00:00:00 2001 From: Dave Sugar Date: Fri, 14 Jul 2023 13:41:07 -0400 Subject: [PATCH] Allow local login to read /run/motd node=localhost type=AVC msg=audit(1689384764.155:53945): avc: denied { getattr } for pid=5125 comm="login" path="/run/motd" dev="tmpfs" ino=1574 scontext=system_u:system_r:local_login_t:s0 tcontext=system_u:object_r:pam_motd_runtime_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1689384764.155:53946): avc: denied { read } for pid=5125 comm="login" name="motd" dev="tmpfs" ino=1574 scontext=system_u:system_r:local_login_t:s0 tcontext=system_u:object_r:pam_motd_runtime_t:s0 tclass=file permissive=1 node=localhost type=AVC msg=audit(1689384764.155:53946): avc: denied { open } for pid=5125 comm="login" path="/run/motd" dev="tmpfs" ino=1574 scontext=system_u:system_r:local_login_t:s0 tcontext=system_u:object_r:pam_motd_runtime_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar --- policy/modules/system/authlogin.if | 19 +++++++++++++++++++ policy/modules/system/locallogin.te | 1 + 2 files changed, 20 insertions(+) diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if index 4a2bfbccbb..442a37b16b 100644 --- a/policy/modules/system/authlogin.if +++ b/policy/modules/system/authlogin.if @@ -118,6 +118,25 @@ interface(`auth_use_pam_motd_dynamic',` files_runtime_filetrans($1, pam_motd_runtime_t, file, "motd.dynamic.new") ') +######################################## +## +## Read the pam module motd with dynamic support during authentication. +## +## +## +## Domain allowed access. +## +## +# +interface(`auth_read_pam_motd_dynamic',` + gen_require(` + type pam_motd_runtime_t; + ') + + files_search_runtime($1) + allow $1 pam_motd_runtime_t:file read_file_perms; +') + ######################################## ## ## Make the specified domain used for a login program. diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te index 7728de8040..89311a323d 100644 --- a/policy/modules/system/locallogin.te +++ b/policy/modules/system/locallogin.te @@ -128,6 +128,7 @@ auth_manage_pam_runtime_dirs(local_login_t) auth_manage_pam_runtime_files(local_login_t) auth_manage_pam_console_data(local_login_t) auth_domtrans_pam_console(local_login_t) +auth_read_pam_motd_dynamic(local_login_t) init_dontaudit_use_fds(local_login_t)