Miscellaneous missing permissions while running a sid vm:


#============= systemd_tmpfiles_t ==============
allow systemd_tmpfiles_t boolean_type:file getattr;
allow systemd_tmpfiles_t configfs_t:dir list_dir_perms;
allow systemd_tmpfiles_t security_t:lnk_file getattr;
allow systemd_tmpfiles_t tracefs_t:dir list_dir_perms;
allow systemd_tmpfiles_t tracefs_t:file getattr;


#============= quota_t ==============
allow quota_t locale_t:file map;


#============= udev_t ==============
# /run/console-setup
allow udev_t initrc_runtime_t:dir add_entry_dir_perms;
allow udev_t initrc_runtime_t:file create_file_perms;

allow udev_t cgroup_t:dir { add_name create write };
allow udev_t cgroup_t:file write;


#============= kmod_t ==============
# /usr/lib/ssl/openssl.cnf
miscfiles_read_generic_certs(kmod_t)


#============= unconfined_t ==============
allow unconfined_t self:file { relabelfrom unlink };


#============= systemd_sysusers_t ==============
#  type=PROCTITLE msg=audit(31/08/22 14:33:20.321:106) :
proctitle=systemd-sysusers systemd-journal.conf systemd-network.conf
#  type=PATH msg=audit(31/08/22 14:33:20.321:106) : item=1
name=/lib64/ld-linux-x86-64.so.2 inode=130833 dev=fe:01 mode=file,755
ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0
nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0
cap_frootid=0
#  type=PATH msg=audit(31/08/22 14:33:20.321:106) : item=0
name=/usr/bin/systemd-sysusers inode=132750 dev=fe:01 mode=file,755
ouid=root ogid=root rdev=00:00
obj=system_u:object_r:systemd_sysusers_exec_t:s0 nametype=NORMAL
cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
#  type=CWD msg=audit(31/08/22 14:33:20.321:106) : cwd=/
#  type=EXECVE msg=audit(31/08/22 14:33:20.321:106) : argc=3
a0=systemd-sysusers a1=systemd-journal.conf a2=systemd-network.conf
#  type=SYSCALL msg=audit(31/08/22 14:33:20.321:106) : arch=x86_64
syscall=execve success=yes exit=0 a0=0x56b182488a58 a1=0x56b180add980
a2=0x56b182488948 a3=0x8 items=2 ppid=3299 pid=3302 auid=root uid=root
gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root
tty=(none) ses=1 comm=systemd-sysuser exe=/usr/bin/systemd-sysusers
subj=unconfined_u:unconfined_r:systemd_sysusers_t:s0-s0:c0.c1023
key=(null)
#  type=AVC msg=audit(31/08/22 14:33:20.321:106) : avc:  denied  { use
} for  pid=3302 comm=systemd-sysuser path=/dev/pts/4 dev="devpts"
ino=7 scontext=unconfined_u:unconfined_r:systemd_sysusers_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tclass=fd permissive=0
#  type=AVC msg=audit(31/08/22 14:33:20.321:106) : avc:  denied  { use
} for  pid=3302 comm=systemd-sysuser path=/dev/pts/4 dev="devpts"
ino=7 scontext=unconfined_u:unconfined_r:systemd_sysusers_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tclass=fd permissive=0
#  type=AVC msg=audit(31/08/22 14:33:20.321:106) : avc:  denied  { use
} for  pid=3302 comm=systemd-sysuser path=/dev/pts/4 dev="devpts"
ino=7 scontext=unconfined_u:unconfined_r:systemd_sysusers_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tclass=fd permissive=0
#  type=AVC msg=audit(31/08/22 14:33:20.321:106) : avc:  denied  {
read write } for  pid=3302 comm=systemd-sysuser path=/dev/pts/4
dev="devpts" ino=7
scontext=unconfined_u:unconfined_r:systemd_sysusers_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_devpts_t:s0 tclass=chr_file
permissive=0

allow systemd_sysusers_t unconfined_t:fd use;
allow systemd_sysusers_t user_devpts_t:chr_file { read write };

Re-checked on a new installed bookworm system:


type=PROCTITLE msg=audit(01/04/23 19:09:55.035:61) :
proctitle=restorecon -vv -R -F -n -T 0 /
type=PATH msg=audit(01/04/23 19:09:55.035:61) : item=0
name=/proc/sys/vm/overcommit_memory inode=14256 dev=00:14
mode=file,644 ouid=root ogid=root rdev=00:00
obj=system_u:object_r:sysctl_vm_overcommit_t:s0 nametype=NORMAL
cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap
_frootid=0
type=CWD msg=audit(01/04/23 19:09:55.035:61) : cwd=/root
type=SYSCALL msg=audit(01/04/23 19:09:55.035:61) : arch=x86_64
syscall=openat success=yes exit=3 a0=AT_FDCWD a1=0x7f509abf42f0
a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=589 pid=609 auid=root
uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root
fsgid=roo
t tty=pts1 ses=1 comm=restorecon exe=/usr/sbin/setfiles
subj=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(01/04/23 19:09:55.035:61) : avc:  denied  { open }
for  pid=609 comm=restorecon path=/proc/sys/vm/overcommit_memory
dev="proc" ino=14256
scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sysctl_vm_overcommit_t:s0
 tclass=file permissive=1
type=AVC msg=audit(01/04/23 19:09:55.035:61) : avc:  denied  { read }
for  pid=609 comm=restorecon name=overcommit_memory dev="proc"
ino=14256 scontext=unconfined_u:unconfined_r:setfiles_t:s0-s0:c0.c1023
tcontext=system_u:object_r:sysctl_vm_overcommit_t:s0 tclass=file
permissive=1

Probably due to the usage of the -T flag

+kernel_read_vm_overcommit_sysctl(setfiles_t)


type=PROCTITLE msg=audit(01/04/23 19:09:13.052:32) :
proctitle=/usr/sbin/vnstatd -n
type=PATH msg=audit(01/04/23 19:09:13.052:32) : item=0
name=/dev/urandom inode=18 dev=00:2c mode=character,666 ouid=root
ogid=root rdev=01:09 obj=system_u:object_r:urandom_device_t:s0
nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0
cap_frootid=0
type=CWD msg=audit(01/04/23 19:09:13.052:32) : cwd=/
type=SYSCALL msg=audit(01/04/23 19:09:13.052:32) : arch=x86_64
syscall=openat success=yes exit=5 a0=AT_FDCWD a1=0x7f76a2fa5acc
a2=O_RDONLY|O_CLOEXEC a3=0x0 items=1 ppid=1 pid=557 auid=unset
uid=vnstat gid=vnstat euid=vnstat suid=vnstat fsuid=vnstat egid=vnstat
sgid=vnstat fsgid=vnstat tty=(none) ses=unset comm=vnstatd
exe=/usr/sbin/vnstatd subj=system_u:system_r:vnstatd_t:s0 key=(null)
type=AVC msg=audit(01/04/23 19:09:13.052:32) : avc:  denied  { open }
for  pid=557 comm=vnstatd path=/dev/urandom dev="tmpfs" ino=18
scontext=system_u:system_r:vnstatd_t:s0
tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
permissive=1
type=AVC msg=audit(01/04/23 19:09:13.052:32) : avc:  denied  { read }
for  pid=557 comm=vnstatd name=urandom dev="tmpfs" ino=18
scontext=system_u:system_r:vnstatd_t:s0
tcontext=system_u:object_r:urandom_device_t:s0 tclass=chr_file
permissive=1

+dev_read_urand(vnstatd_t)


Apr 01 19:09:12 debianrefpolicy kernel: audit: type=1400
audit(1680368952.624:6): avc:  denied  { relabelfrom } for  pid=488
comm="systemd-tmpfile" name="mtab" dev="vda1" ino=261264
scontext=system_u:system_r:systemd_tmpfiles_t:s0
tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
Apr 01 19:09:12 debianrefpolicy kernel: audit: type=1400
audit(1680368952.624:7): avc:  denied  { relabelto } for  pid=488
comm="systemd-tmpfile" name="mtab" dev="vda1" ino=261264
scontext=system_u:system_r:systemd_tmpfiles_t:s0
tcontext=system_u:object_r:etc_t:s0 tclass=lnk_file permissive=1
Apr 01 19:09:12 debianrefpolicy kernel: audit: type=1400
audit(1680368952.624:8): avc:  denied  { relabelfrom } for  pid=488
comm="systemd-tmpfile" name="root" dev="vda1" ino=1044482
scontext=system_u:system_r:systemd_tmpfiles_t:s0
tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
permissive=1
Apr 01 19:09:12 debianrefpolicy kernel: audit: type=1400
audit(1680368952.628:9): avc:  denied  { relabelto } for  pid=488
comm="systemd-tmpfile" name="root" dev="vda1" ino=1044482
scontext=system_u:system_r:systemd_tmpfiles_t:s0
tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir
permissive=1
Apr 01 19:09:12 debianrefpolicy kernel: audit: type=1400
audit(1680368952.628:10): avc:  denied  { relabelfrom } for  pid=488
comm="systemd-tmpfile" name=".ssh" dev="vda1" ino=1044487
scontext=system_u:system_r:systemd_tmpfiles_t:s0
tcontext=unconfined_u:object_r:ssh_home_t:s0 tclass=dir permissive=1

Caused by /usr/lib/tmpfiles.d/provision.conf

+allow systemd_tmpfiles_t etc_t:lnk_file { relabelfrom relabelto };
+allow systemd_tmpfiles_t ssh_home_t:dir { relabelfrom relabelto };
+allow systemd_tmpfiles_t user_home_dir_t:dir { relabelfrom relabelto };
# label files with user unconfined_u running as user system_u
+domain_obj_id_change_exemption(systemd_tmpfiles_t)



type=PROCTITLE msg=audit(01/04/23 19:42:13.993:72) : proctitle=userdel vnstat
type=PATH msg=audit(01/04/23 19:42:13.993:72) : item=0
name=/proc/484/root inode=2 dev=fe:01 mode=dir,755 ouid=root ogid=root
rdev=00:00 obj=system_u:object_r:root_t:s0 nametype=NORMAL cap_fp=none
cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(01/04/23 19:42:13.993:72) : cwd=/
type=SYSCALL msg=audit(01/04/23 19:42:13.993:72) : arch=x86_64
syscall=newfstatat success=yes exit=0 a0=AT_FDCWD a1=0x7ffcaa762780
a2=0x7ffcaa7626d0 a3=0x0 items=1 ppid=659 pid=660 auid=root uid=root
gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=roo
t tty=pts4 ses=1 comm=userdel exe=/usr/sbin/userdel
subj=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(01/04/23 19:42:13.993:72) : avc:  denied  {
sys_ptrace } for  pid=660 comm=userdel capability=sys_ptrace
scontext=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023
tclass=capability permis
sive=1

+allow useradd_t self:capability sys_ptrace;


type=PROCTITLE msg=audit(01/04/23 19:43:51.042:119) :
proctitle=/sbin/groupadd -g 110 vnstat
type=SYSCALL msg=audit(01/04/23 19:43:51.042:119) : arch=x86_64
syscall=fstatfs success=yes exit=0 a0=0x3 a1=0x7ffeed32c5c0 a2=0x0
a3=0x0 items=0 ppid=856 pid=857 auid=root uid=root gid=root euid=root
suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts4 ses=1 c
omm=groupadd exe=/usr/sbin/groupadd
subj=unconfined_u:unconfined_r:groupadd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(01/04/23 19:43:51.042:119) : avc:  denied  {
getattr } for  pid=857 comm=groupadd name=/ dev="proc" ino=1
scontext=unconfined_u:unconfined_r:groupadd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:proc_t:s0 tclass=filesystem permissive=1

+kernel_getattr_proc(groupadd_t)


type=PROCTITLE msg=audit(01/04/23 19:47:34.834:196) : proctitle=plocate /
type=SYSCALL msg=audit(01/04/23 19:47:34.834:196) : arch=x86_64
syscall=io_uring_setup success=yes exit=4 a0=0x100 a1=0x7ffc94fad5c0
a2=0x7ffc94fad5c0 a3=0x7f17e70aa570 items=0 ppid=1224 pid=1225
auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root
sgid
=root fsgid=root tty=pts4 ses=1 comm=plocate exe=/usr/bin/plocate
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(01/04/23 19:47:34.834:196) : avc:  denied  { create
} for  pid=1225 comm=plocate anonclass=[io_uring]
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:unconfined_t:s0 tclass=anon_inode
permissive=1
----
type=PROCTITLE msg=audit(01/04/23 19:47:34.834:197) : proctitle=plocate /
type=MMAP msg=audit(01/04/23 19:47:34.834:197) : fd=4
flags=MAP_SHARED|MAP_POPULATE
type=SYSCALL msg=audit(01/04/23 19:47:34.834:197) : arch=x86_64
syscall=mmap success=yes exit=139740637237248 a0=0x0 a1=0x2540
a2=PROT_READ|PROT_WRITE a3=MAP_SHARED|MAP_POPULATE items=0 ppid=1224
pid=1225 auid=root uid=root gid=root euid=root suid=root fsuid=root
egid=
root sgid=root fsgid=root tty=pts4 ses=1 comm=plocate
exe=/usr/bin/plocate
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(01/04/23 19:47:34.834:197) : avc:  denied  { read
write } for  pid=1225 comm=plocate path=anon_inode:[io_uring]
dev="anon_inodefs" ino=20748
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:unconfined_t:s0
 tclass=anon_inode permissive=1
type=AVC msg=audit(01/04/23 19:47:34.834:197) : avc:  denied  { map }
for  pid=1225 comm=plocate path=anon_inode:[io_uring]
dev="anon_inodefs" ino=20748
scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:unconfined_t:s0 tclass
=anon_inode permissive=1

Usage of io_uring, e.g. in plocate

+allow unconfined_t self:anon_inode { create map read write };



Apr 01 19:09:12 debianrefpolicy kernel: audit: type=1400
audit(1680368952.052:3): avc:  denied  { create } for  pid=375
comm="mkdir" name="console-setup" scontext=system_u:system_r:udev_t:s0
tcontext=system_u:object_r:var_run_t:s0 tclass=dir permissive=1
Apr 01 19:09:12 debianrefpolicy kernel: audit: type=1400
audit(1680368952.052:4): avc:  denied  { create } for  pid=334
comm="cached_setup_fo" name="font-loaded"
scontext=system_u:system_r:udev_t:s0
tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=1
Apr 01 19:09:12 debianrefpolicy kernel: audit: type=1400
audit(1680368952.052:5): avc:  denied  { write open } for  pid=334
comm="cached_setup_fo" path="/run/console-setup/font-loaded"
dev="tmpfs" ino=721 scontext=system_u:system_r:udev_t:s0
tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=1

Since there are some Debian patches to the refpolicy regarding
/run/console-setup, I am not sure what your preferred resolution would
be.

added

added

I'll look into that one later.

How can you reproduce that?  I had been considering it but don't know what
it's for.

Added.

added

I'll look into that later.