systemd: permit sysusers to create /etc/group

audit[14480]: AVC avc: denied { create } for pid=14480 comm="systemd-sysuser" name=".#group5f44baae46cc7c1d" scontext=unconfined_u:unconfined_r:systemd_sysusers_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0 Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
SELinuxProject · Nov 28, 2024 · 2765e7f · 2765e7f
1 parent 6e54a2e
commit 2765e7f
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
@@ -302,6 +302,8 @@ init_daemon_domain(systemd_sysctl_t, systemd_sysctl_exec_t)
 type systemd_sysusers_t;
 type systemd_sysusers_exec_t;
 init_system_domain(systemd_sysusers_t, systemd_sysusers_exec_t)
+# create /etc/group
+domain_obj_id_change_exemption(systemd_sysusers_t)
 role systemd_sysusers_roles types systemd_sysusers_t;
 
 type systemd_tmpfiles_t;