{"action":"created","issue":{"url":"https://api.github.com/repos/TresysTechnology/clip/issues/118","labels_url":"https://api.github.com/repos/TresysTechnology/clip/issues/118/labels{/name}","comments_url":"https://api.github.com/repos/TresysTechnology/clip/issues/118/comments","events_url":"https://api.github.com/repos/TresysTechnology/clip/issues/118/events","html_url":"https://github.com/TresysTechnology/clip/issues/118","id":70180630,"number":118,"title":"Resolve init denials","user":{"login":"mpalmi","id":7817675,"avatar_url":"https://avatars.githubusercontent.com/u/7817675?v=3","gravatar_id":"","url":"https://api.github.com/users/mpalmi","html_url":"https://github.com/mpalmi","followers_url":"https://api.github.com/users/mpalmi/followers","following_url":"https://api.github.com/users/mpalmi/following{/other_user}","gists_url":"https://api.github.com/users/mpalmi/gists{/gist_id}","starred_url":"https://api.github.com/users/mpalmi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpalmi/subscriptions","organizations_url":"https://api.github.com/users/mpalmi/orgs","repos_url":"https://api.github.com/users/mpalmi/repos","events_url":"https://api.github.com/users/mpalmi/events{/privacy}","received_events_url":"https://api.github.com/users/mpalmi/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/TresysTechnology/clip/labels/High%20Priority","name":"High Priority","color":"fbca04"},{"url":"https://api.github.com/repos/TresysTechnology/clip/labels/long-task","name":"long-task","color":"5319e7"},{"url":"https://api.github.com/repos/TresysTechnology/clip/labels/selinux","name":"selinux","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/TresysTechnology/clip/milestones/7","html_url":"https://github.com/TresysTechnology/clip/milestones/RHEL_7-Alpha3","labels_url":"https://api.github.com/repos/TresysTechnology/clip/milestones/7/labels","id":998208,"number":7,"title":"RHEL_7-Alpha3","description":"CLIP will boot in enforcing with systemd policy completed.","creator":{"login":"ykhodorkovskiy","id":3766888,"avatar_url":"https://avatars.githubusercontent.com/u/3766888?v=3","gravatar_id":"","url":"https://api.github.com/users/ykhodorkovskiy","html_url":"https://github.com/ykhodorkovskiy","followers_url":"https://api.github.com/users/ykhodorkovskiy/followers","following_url":"https://api.github.com/users/ykhodorkovskiy/following{/other_user}","gists_url":"https://api.github.com/users/ykhodorkovskiy/gists{/gist_id}","starred_url":"https://api.github.com/users/ykhodorkovskiy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ykhodorkovskiy/subscriptions","organizations_url":"https://api.github.com/users/ykhodorkovskiy/orgs","repos_url":"https://api.github.com/users/ykhodorkovskiy/repos","events_url":"https://api.github.com/users/ykhodorkovskiy/events{/privacy}","received_events_url":"https://api.github.com/users/ykhodorkovskiy/received_events","type":"User","site_admin":false},"open_issues":20,"closed_issues":18,"state":"open","created_at":"2015-02-27T03:04:00Z","updated_at":"2015-05-06T18:18:11Z","due_on":null,"closed_at":null},"comments":11,"created_at":"2015-04-22T17:01:32Z","updated_at":"2015-05-06T21:42:19Z","closed_at":null,"body":"In order to get this system booting in Enforcing, we will need to resolve the remaining init_t (pid 1) denials.\r\n\r\nAssumptions:\r\n- Work will be done off of mpalmi/clip@95bafa004072cff0cfef3bf12e7357e0f1ad998b\r\n- Allow rules are needed to get CLIP booting in Enforcing\r\n- Least privilege access model will be employed\r\n- refpolicy guidelines for policy [development](https://github.com/TresysTechnology/refpolicy/wiki/Documentation) will be followed.\r\n\r\nSubtasks:\r\n- [x] Ensure all files are properly labeled.\r\n- [x] Resolve tmpfs_t denials.\r\n- [x] Resolve logging-related denials.\r\n- [x] Resolve device-related denials.\r\n- [x] Resolve shutdown-related denials.\r\n- [x] Resolve user-related denials.\r\n\r\n----\r\n\r\naudit2allow\r\n<pre>\r\n#============= auditctl_t ==============\r\nallow auditctl_t init_t:unix_stream_socket getattr;\r\n\r\n#============= dhcpc_t ==============\r\nallow dhcpc_t init_t:unix_stream_socket getattr;\r\n\r\n#============= init_t ==============\r\nallow init_t autofs_device_t:chr_file { read open };\r\nallow init_t device_t:dir create;\r\nallow init_t devlog_t:sock_file relabelto;\r\nallow init_t devpts_t:dir { relabelfrom relabelto };\r\nallow init_t hugetlbfs_t:dir { read create open };\r\nallow init_t proc_t:filesystem getattr;\r\nallow init_t self:netlink_kobject_uevent_socket { bind create setopt getattr };\r\nallow init_t shutdown_t:process share;\r\nallow init_t sysctl_fs_t:dir { search getattr };\r\nallow init_t systemd_shutdownd_t:unix_dgram_socket { bind create setopt };\r\nallow init_t tmpfs_t:file read;\r\nallow init_t tmpfs_t:filesystem getattr;\r\nallow init_t var_log_t:dir relabelto;\r\nallow init_t var_log_t:file relabelto;\r\n\r\n#============= initrc_t ==============\r\nallow initrc_t init_t:unix_stream_socket { read write ioctl getattr };\r\n\r\n#============= sshd_keygen_t ==============\r\nallow sshd_keygen_t init_t:unix_stream_socket getattr;\r\n\r\n#============= staff_t ==============\r\nallow staff_t init_t:unix_stream_socket connectto;\r\nallow staff_t power_unit_file_t:service start;\r\n</pre>\r\n\r\naudit.log\r\n<pre>\r\n6:type=AVC msg=audit(1429719718.508:729): avc:  denied  { connectto } for  pid=1906 comm=\"reboot\" path=\"/run/systemd/private\" scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n8:type=USER_AVC msg=audit(1429719718.523:730): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=0 uid=0 gid=0 path=\"/usr/lib/systemd/system/reboot.target\" cmdline=\"reboot\" scontext=root:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:power_unit_file_t:s0 tclass=service  exe=\"/usr/lib/systemd/systemd\" sauid=0 hostname=? addr=? terminal=?'\r\n26:type=SERVICE_STOP msg=audit(1429719718.544:742): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"rhel-dmesg\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n31:type=SERVICE_STOP msg=audit(1429719718.576:746): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-logind\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=failed'\r\n32:type=SERVICE_STOP msg=audit(1429719718.577:747): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"dbus\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n33:type=SERVICE_STOP msg=audit(1429719718.580:748): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"crond\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n34:type=SERVICE_STOP msg=audit(1429719718.584:749): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"firewalld\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=failed'\r\n35:type=SERVICE_STOP msg=audit(1429719718.597:750): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"getty@tty1\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n36:type=SERVICE_STOP msg=audit(1429719718.599:751): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"rsyslog\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n37:type=SERVICE_STOP msg=audit(1429719718.600:752): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"chronyd\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n38:type=SERVICE_STOP msg=audit(1429719718.601:753): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"sshd\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n39:type=AVC msg=audit(1429719718.618:754): avc:  denied  { read write } for  pid=1923 comm=\"network\" path=\"socket:[16495]\" dev=\"sockfs\" ino=16495 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n41:type=AVC msg=audit(1429719718.622:755): avc:  denied  { ioctl } for  pid=1924 comm=\"systemd-user-se\" path=\"socket:[16540]\" dev=\"sockfs\" ino=16540 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n43:type=SERVICE_STOP msg=audit(1429719718.623:756): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"lvm2-pvscan@8:2\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n44:type=SERVICE_START msg=audit(1429719718.625:757): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-logind\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=failed'\r\n45:type=AVC msg=audit(1429719718.625:758): avc:  denied  { getattr } for  pid=1923 comm=\"network\" path=\"socket:[16495]\" dev=\"sockfs\" ino=16495 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n47:type=SERVICE_STOP msg=audit(1429719718.630:759): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-user-sessions\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n56:type=AVC msg=audit(1429719719.128:764): avc:  denied  { getattr } for  pid=1997 comm=\"dhclient-script\" path=\"socket:[16495]\" dev=\"sockfs\" ino=16495 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n62:type=SERVICE_START msg=audit(1429719719.163:767): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"dracut-shutdown\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n63:type=SERVICE_STOP msg=audit(1429719719.488:768): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"network\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n64:type=SERVICE_STOP msg=audit(1429719719.506:769): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-sysctl\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n66:type=SERVICE_STOP msg=audit(1429719719.511:771): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-vconsole-setup\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n68:type=SERVICE_STOP msg=audit(1429719719.529:772): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-random-seed\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n70:type=SERVICE_STOP msg=audit(1429719719.532:774): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-update-utmp\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n71:type=DAEMON_END msg=audit(1429719719.540:1453): auditd normal halt, sending auid=0 pid=1 subj=system_u:system_r:init_t:s0 res=success\r\n108:type=AVC msg=audit(1429719730.516:37): avc:  denied  { relabelfrom } for  pid=1 comm=\"systemd\" name=\"/\" dev=\"devpts\" ino=1 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=dir\r\n109:type=AVC msg=audit(1429719730.516:38): avc:  denied  { relabelto } for  pid=1 comm=\"systemd\" name=\"/\" dev=\"devpts\" ino=1 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=dir\r\n110:type=AVC msg=audit(1429719730.522:39): avc:  denied  { relabelto } for  pid=1 comm=\"systemd\" name=\"log\" dev=\"devtmpfs\" ino=5973 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:devlog_t:s0 tclass=sock_file\r\n111:type=AVC msg=audit(1429719730.528:40): avc:  denied  { relabelto } for  pid=1 comm=\"systemd\" name=\"log\" dev=\"tmpfs\" ino=6043 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=dir\r\n112:type=AVC msg=audit(1429719730.528:41): avc:  denied  { relabelto } for  pid=1 comm=\"systemd\" name=\"system.journal\" dev=\"tmpfs\" ino=6048 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file\r\n113:type=AVC msg=audit(1429719731.148:42): avc:  denied  { create } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_kobject_uevent_socket\r\n114:type=AVC msg=audit(1429719731.148:43): avc:  denied  { setopt } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_kobject_uevent_socket\r\n115:type=AVC msg=audit(1429719731.148:44): avc:  denied  { bind } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_kobject_uevent_socket\r\n116:type=AVC msg=audit(1429719731.148:45): avc:  denied  { getattr } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_kobject_uevent_socket\r\n117:type=AVC msg=audit(1429719731.150:46): avc:  denied  { read } for  pid=1 comm=\"systemd\" path=2F72756E2F73797374656D642F64756D702D312D57416A416A4F202864656C6574656429 dev=\"tmpfs\" ino=8356 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file\r\n118:type=SERVICE_START msg=audit(1429719731.184:47): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-journald\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n119:type=SERVICE_STOP msg=audit(1429719731.184:48): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-journald\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n120:type=SERVICE_START msg=audit(1429719731.187:49): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"initrd-switch-root\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n121:type=SERVICE_STOP msg=audit(1429719731.187:50): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"initrd-switch-root\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n122:type=SERVICE_START msg=audit(1429719731.193:51): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-fsck@dev-disk-by\\x2duuid-54e08250\\x2df15d\\x2d47ab\\x2da254\\x2d3be33121a276\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n123:type=SERVICE_STOP msg=audit(1429719731.193:52): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-fsck@dev-disk-by\\x2duuid-54e08250\\x2df15d\\x2d47ab\\x2da254\\x2d3be33121a276\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n124:type=AVC msg=audit(1429719731.223:53): avc:  denied  { create } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:systemd_shutdownd_t:s0 tclass=unix_dgram_socket\r\n125:type=AVC msg=audit(1429719731.223:54): avc:  denied  { setopt } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:systemd_shutdownd_t:s0 tclass=unix_dgram_socket\r\n126:type=AVC msg=audit(1429719731.223:55): avc:  denied  { bind } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:systemd_shutdownd_t:s0 tclass=unix_dgram_socket\r\n127:type=AVC msg=audit(1429719731.225:56): avc:  denied  { create } for  pid=1 comm=\"systemd\" name=\"hugepages\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=dir\r\n128:type=AVC msg=audit(1429719731.225:57): avc:  denied  { read } for  pid=1 comm=\"systemd\" name=\"hugepages\" dev=\"devtmpfs\" ino=8703 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=dir\r\n129:type=AVC msg=audit(1429719731.225:58): avc:  denied  { open } for  pid=1 comm=\"systemd\" path=\"/dev/hugepages\" dev=\"devtmpfs\" ino=8703 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=dir\r\n130:type=AVC msg=audit(1429719731.227:59): avc:  denied  { search } for  pid=1 comm=\"systemd\" name=\"fs\" dev=\"proc\" ino=6133 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=dir\r\n131:type=AVC msg=audit(1429719731.228:60): avc:  denied  { create } for  pid=1 comm=\"systemd\" name=\"mqueue\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=dir\r\n132:type=AVC msg=audit(1429719731.246:61): avc:  denied  { getattr } for  pid=1 comm=\"systemd\" name=\"/\" dev=\"proc\" ino=1 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem\r\n133:type=AVC msg=audit(1429719731.246:62): avc:  denied  { getattr } for  pid=1 comm=\"systemd\" path=\"/proc/sys/fs/binfmt_misc\" dev=\"proc\" ino=8845 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=dir\r\n134:type=AVC msg=audit(1429719731.246:63): avc:  denied  { read } for  pid=1 comm=\"systemd\" name=\"autofs\" dev=\"devtmpfs\" ino=5648 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:autofs_device_t:s0 tclass=chr_file\r\n135:type=AVC msg=audit(1429719731.246:64): avc:  denied  { open } for  pid=1 comm=\"systemd\" path=\"/dev/autofs\" dev=\"devtmpfs\" ino=5648 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:autofs_device_t:s0 tclass=chr_file\r\n136:type=SERVICE_START msg=audit(1429719735.525:242): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"auditd\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n138:type=SERVICE_START msg=audit(1429719735.549:244): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-update-utmp\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n151:type=AVC msg=audit(1429719743.894:252): avc:  denied  { search } for  pid=1 comm=\"systemd\" name=\"fs\" dev=\"proc\" ino=6133 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=dir\r\n152:type=AVC msg=audit(1429719743.896:253): avc:  denied  { getattr } for  pid=1 comm=\"systemd\" name=\"/\" dev=\"tmpfs\" ino=5724 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem\r\n153:type=AVC msg=audit(1429719743.896:254): avc:  denied  { share } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:shutdown_t:s0 tclass=process\r\n194:type=AVC msg=audit(1429719755.499:37): avc:  denied  { relabelfrom } for  pid=1 comm=\"systemd\" name=\"/\" dev=\"devpts\" ino=1 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=dir\r\n195:type=AVC msg=audit(1429719755.499:38): avc:  denied  { relabelto } for  pid=1 comm=\"systemd\" name=\"/\" dev=\"devpts\" ino=1 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:devpts_t:s0 tclass=dir\r\n196:type=AVC msg=audit(1429719755.504:39): avc:  denied  { relabelto } for  pid=1 comm=\"systemd\" name=\"log\" dev=\"devtmpfs\" ino=5973 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:devlog_t:s0 tclass=sock_file\r\n197:type=AVC msg=audit(1429719755.508:40): avc:  denied  { relabelto } for  pid=1 comm=\"systemd\" name=\"log\" dev=\"tmpfs\" ino=6048 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=dir\r\n198:type=AVC msg=audit(1429719755.509:41): avc:  denied  { relabelto } for  pid=1 comm=\"systemd\" name=\"system.journal\" dev=\"tmpfs\" ino=6051 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file\r\n199:type=AVC msg=audit(1429719756.190:42): avc:  denied  { create } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_kobject_uevent_socket\r\n200:type=AVC msg=audit(1429719756.190:43): avc:  denied  { setopt } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_kobject_uevent_socket\r\n201:type=AVC msg=audit(1429719756.190:44): avc:  denied  { bind } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_kobject_uevent_socket\r\n202:type=AVC msg=audit(1429719756.190:45): avc:  denied  { getattr } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=netlink_kobject_uevent_socket\r\n203:type=AVC msg=audit(1429719756.192:46): avc:  denied  { read } for  pid=1 comm=\"systemd\" path=2F72756E2F73797374656D642F64756D702D312D576F79776562202864656C6574656429 dev=\"tmpfs\" ino=8415 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file\r\n204:type=SERVICE_START msg=audit(1429719756.225:47): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-journald\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n205:type=SERVICE_STOP msg=audit(1429719756.225:48): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-journald\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n206:type=SERVICE_START msg=audit(1429719756.231:49): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"initrd-switch-root\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n207:type=SERVICE_STOP msg=audit(1429719756.231:50): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"initrd-switch-root\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n208:type=SERVICE_START msg=audit(1429719756.237:51): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-fsck@dev-disk-by\\x2duuid-54e08250\\x2df15d\\x2d47ab\\x2da254\\x2d3be33121a276\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n209:type=SERVICE_STOP msg=audit(1429719756.237:52): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-fsck@dev-disk-by\\x2duuid-54e08250\\x2df15d\\x2d47ab\\x2da254\\x2d3be33121a276\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n210:type=AVC msg=audit(1429719756.273:53): avc:  denied  { create } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:systemd_shutdownd_t:s0 tclass=unix_dgram_socket\r\n211:type=AVC msg=audit(1429719756.273:54): avc:  denied  { setopt } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:systemd_shutdownd_t:s0 tclass=unix_dgram_socket\r\n212:type=AVC msg=audit(1429719756.273:55): avc:  denied  { bind } for  pid=1 comm=\"systemd\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:systemd_shutdownd_t:s0 tclass=unix_dgram_socket\r\n213:type=AVC msg=audit(1429719756.280:56): avc:  denied  { create } for  pid=1 comm=\"systemd\" name=\"hugepages\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=dir\r\n214:type=AVC msg=audit(1429719756.280:57): avc:  denied  { read } for  pid=1 comm=\"systemd\" name=\"hugepages\" dev=\"devtmpfs\" ino=8762 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=dir\r\n215:type=AVC msg=audit(1429719756.280:58): avc:  denied  { open } for  pid=1 comm=\"systemd\" path=\"/dev/hugepages\" dev=\"devtmpfs\" ino=8762 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=dir\r\n216:type=AVC msg=audit(1429719756.282:59): avc:  denied  { search } for  pid=1 comm=\"systemd\" name=\"fs\" dev=\"proc\" ino=6162 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=dir\r\n217:type=AVC msg=audit(1429719756.285:60): avc:  denied  { create } for  pid=1 comm=\"systemd\" name=\"mqueue\" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=dir\r\n218:type=AVC msg=audit(1429719756.304:61): avc:  denied  { getattr } for  pid=1 comm=\"systemd\" name=\"/\" dev=\"proc\" ino=1 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem\r\n219:type=AVC msg=audit(1429719756.304:62): avc:  denied  { getattr } for  pid=1 comm=\"systemd\" path=\"/proc/sys/fs/binfmt_misc\" dev=\"proc\" ino=8904 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=dir\r\n220:type=AVC msg=audit(1429719756.304:63): avc:  denied  { read } for  pid=1 comm=\"systemd\" name=\"autofs\" dev=\"devtmpfs\" ino=5648 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:autofs_device_t:s0 tclass=chr_file\r\n221:type=AVC msg=audit(1429719756.304:64): avc:  denied  { open } for  pid=1 comm=\"systemd\" path=\"/dev/autofs\" dev=\"devtmpfs\" ino=5648 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:autofs_device_t:s0 tclass=chr_file\r\n224:type=AVC msg=audit(1429719760.417:234): avc:  denied  { getattr } for  pid=584 comm=\"awk\" path=\"socket:[12466]\" dev=\"sockfs\" ino=12466 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n226:type=AVC msg=audit(1429719760.535:235): avc:  denied  { getattr } for  pid=591 comm=\"auditctl\" path=\"socket:[12466]\" dev=\"sockfs\" ino=12466 scontext=system_u:system_r:auditctl_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n229:type=SERVICE_START msg=audit(1429719760.540:237): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"auditd\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n231:type=SERVICE_START msg=audit(1429719760.567:239): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-update-utmp\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n232:type=SERVICE_START msg=audit(1429719760.620:240): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"dbus\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n233:type=SERVICE_START msg=audit(1429719760.778:241): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-user-sessions\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n234:type=SERVICE_START msg=audit(1429719760.817:242): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"crond\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n235:type=SERVICE_START msg=audit(1429719760.822:243): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"getty@tty1\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n236:type=SERVICE_START msg=audit(1429719761.008:244): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"rsyslog\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n238:type=SERVICE_START msg=audit(1429719761.073:246): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-logind\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n239:type=SERVICE_START msg=audit(1429719761.255:247): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"rhel-dmesg\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n240:type=AVC msg=audit(1429719761.259:248): avc:  denied  { getattr } for  pid=622 comm=\"init.ipv6-globa\" path=\"socket:[13047]\" dev=\"sockfs\" ino=13047 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n242:type=AVC msg=audit(1429719761.309:249): avc:  denied  { read write } for  pid=629 comm=\"chrony-helper\" path=\"socket:[13407]\" dev=\"sockfs\" ino=13407 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n244:type=SERVICE_START msg=audit(1429719761.363:250): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"chronyd\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n245:type=AVC msg=audit(1429719761.402:251): avc:  denied  { ioctl } for  pid=643 comm=\"systemd-sysctl\" path=\"socket:[13047]\" dev=\"sockfs\" ino=13047 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n252:type=AVC msg=audit(1429719762.872:254): avc:  denied  { getattr } for  pid=745 comm=\"dhclient-script\" path=\"socket:[13047]\" dev=\"sockfs\" ino=13047 scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n280:type=SERVICE_START msg=audit(1429719763.590:268): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"firewalld\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n878:type=SERVICE_START msg=audit(1429719765.595:566): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"network\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n881:type=AVC msg=audit(1429719765.627:568): avc:  denied  { getattr } for  pid=1233 comm=\"sshd-keygen\" path=\"socket:[14950]\" dev=\"sockfs\" ino=14950 scontext=system_u:system_r:sshd_keygen_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n885:type=SERVICE_START msg=audit(1429719765.649:570): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"sshd\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n886:type=AVC msg=audit(1429719765.659:571): avc:  denied  { read write } for  pid=1237 comm=\"systemd-update-\" path=\"socket:[15058]\" dev=\"sockfs\" ino=15058 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n888:type=AVC msg=audit(1429719765.659:572): avc:  denied  { ioctl } for  pid=1237 comm=\"systemd-update-\" path=\"socket:[15058]\" dev=\"sockfs\" ino=15058 scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket\r\n891:type=SERVICE_START msg=audit(1429719765.662:574): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-update-utmp-runlevel\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n892:type=SERVICE_STOP msg=audit(1429719765.662:575): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-update-utmp-runlevel\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=success'\r\n</pre>\r\n"},"comment":{"url":"https://api.github.com/repos/TresysTechnology/clip/issues/comments/99618300","html_url":"https://github.com/TresysTechnology/clip/issues/118#issuecomment-99618300","issue_url":"https://api.github.com/repos/TresysTechnology/clip/issues/118","id":99618300,"user":{"login":"mpalmi","id":7817675,"avatar_url":"https://avatars.githubusercontent.com/u/7817675?v=3","gravatar_id":"","url":"https://api.github.com/users/mpalmi","html_url":"https://github.com/mpalmi","followers_url":"https://api.github.com/users/mpalmi/followers","following_url":"https://api.github.com/users/mpalmi/following{/other_user}","gists_url":"https://api.github.com/users/mpalmi/gists{/gist_id}","starred_url":"https://api.github.com/users/mpalmi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpalmi/subscriptions","organizations_url":"https://api.github.com/users/mpalmi/orgs","repos_url":"https://api.github.com/users/mpalmi/repos","events_url":"https://api.github.com/users/mpalmi/events{/privacy}","received_events_url":"https://api.github.com/users/mpalmi/received_events","type":"User","site_admin":false},"created_at":"2015-05-06T21:42:19Z","updated_at":"2015-05-06T21:42:19Z","body":">Okay that might not be it, but at least objects formely labeled with that context should now the \"unlabeled_t\"\r\n>\r\n>Any filesystems that arent set up for labeling?\r\n>\r\n>Have a thorough look at dmesg | grep -i selinux\r\n>\r\n>unlabeled_t is a type associated with the unlabeled initial security identifier which is automatically associated by selinux to objects and subjects with one or more invalid security identifiers\r\nwhat avc denials regarding unlabeled_t are you seeing?\r\n\r\n@doverride see: https://github.com/TresysTechnology/clip/issues/118#issuecomment-99120845\r\n\r\n>Could it be possible that it's due to using selinux-policy-targeted in lorax when installing, then switching to clip-selinux-policy?\r\n>\r\n>/usr/lib/systemd/systemd-sysctl is labeled bin_t in clip-selinux-policy, but it's systemd_sysctl_exec_t in selinux-policy-targeted\r\n>\r\n>/etc/hostname is etc_t in clip-selinux-policy, but in selinux-policy-targeted it is hostname_etc_t\r\n\r\n@tomhurd I'll look into that. Thanks for the suggestion"}}