| Summary: | improve SELinux policy for nftables | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | thomasb <gentoo-bugzilla> |
| Component: | SELinux | Assignee: | SE Linux Bugs <selinux> |
| Status: | UNCONFIRMED --- | ||
| Severity: | normal | ||
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
nftable rules cannot be load during system boot. /etc/init.d/nftables instructs nft to read them from /var/lib/nftables/rules-save, which has the wrong context: type=AVC msg=audit(1577610590.822:28): avc: denied { read } for pid=5819 comm="nft" name="rules-save" dev="dm-3" ino=134 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:var_lib_t tclass=file permissive=1 type=AVC msg=audit(1577610590.822:28): avc: denied { open } for pid=5819 comm="nft" path="/var/lib/nftables/rules-save" dev="dm-3" ino=134 scontext=system_u:system_r:iptables_t tcontext=system_u:object_r:var_lib_t tclass=file permissive=1 I fixed it on my system with the following context definition: semanage fcontext -a -s system_u -t iptables_conf_t "/var/lib/nftables(/.*)?" Reproducible: Always Steps to Reproduce: 1. have /etc/init.d/nftables added to default runlevel and let it load the previously saved ruleset on boot 2. reboot your machine 3. run ausearch --start boot -m avc to find the deny messages I posted in this report