634624 – emerge-webrsync wants dac_read_search

Bug 634624 - emerge-webrsync wants dac_read_search

Summary: emerge-webrsync wants dac_read_search

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	SELinux (show other bugs)
Hardware:	All Linux

Importance:	Normal normal
Assignee:	SE Linux Bugs

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2017-10-18 10:26 UTC by Amadeusz Sławiński
Modified:	2018-10-12 21:57 UTC (History)
CC List:	0 users

See Also:
Package list:
Runtime testing required:	---

Attachments
allow dac_read_search for portage_fetch_T (0001-allow-dac_read_search-for-portage_fetch_t.patch,1.20 KB, patch) 2017-10-18 10:26 UTC, Amadeusz Sławiński	Details \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Amadeusz Sławiński 2017-10-18 10:26:09 UTC

Created attachment 499056 [details, diff]
allow dac_read_search for portage_fetch_T

[10069.560815] audit: type=1400 audit(1508321929.772:18620917): avc:  denied  { dac_read_search } for  pid=11683 comm="gpg" capability=2  scontext=staff_u:sysadm_r:portage_fetch_t tcontext=staff_u:sysadm_r:portage_fetch_t tclass=capability permissive=0

dac_override is already allowed and it's impossible to remove it