From 95d7034936ed5f2d01ffcf55a52a5d3c3c8a7825 Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Wed, 21 Sep 2022 13:41:18 +0200
Subject: [PATCH] Allow init read/write inherited user fifo files

This commit backs the usage of "systemd-run --pipe" when standard input,
output, and error of the transient service are inherited from the
systemd-run command itself. The --pipe switch allows systemd-run to be
used within shell pipelines.

Addresses the following AVC denials:

type=AVC msg=audit(09/21/2022 05:24:28.596:328) : avc:  denied  { write } for  pid=1 comm=systemd path=pipe:[16980] dev="pipefs" ino=16980 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=fifo_file permissive=0

type=AVC msg=audit(09/21/2022 05:34:12.088:422) : avc:  denied  { read } for  pid=1 comm=systemd path=pipe:[18554] dev="pipefs" ino=18554 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=fifo_file permissive=0

type=PROCTITLE msg=audit(09/21/2022 05:36:42.853:427) : proctitle=(grep)
type=SYSCALL msg=audit(09/21/2022 05:36:42.853:427) : arch=x86_64 syscall=ioctl success=no exit=EACCES(Permission denied) a0=0x0 a1=TCGETS a2=0x7ffebe2ae1c0 a3=0x0 items=0 ppid=1 pid=1269 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=(grep) exe=/usr/lib/systemd/systemd subj=system_u:system_r:init_t:s0 key=(null)
type=AVC msg=audit(09/21/2022 05:36:42.853:427) : avc:  denied  { ioctl } for  pid=1269 comm=(grep) path=pipe:[18588] dev="pipefs" ino=18588 ioctlcmd=TCGETS scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=fifo_file permissive=0

Resolves: rhbz#2036829
Signed-off-by: lujie42 <lujie54@huawei.com>
---
 policy/modules/system/init.te | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 33052c66f..f369aa50e 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -413,7 +413,7 @@ userdom_manage_tmp_sockets(init_t)
 userdom_delete_user_tmp_files(init_t)
 userdom_delete_user_home_content_files(init_t)
 userdom_connectto_stream(init_t)
-
+userdom_rw_inherited_user_pipes(init_t)
 userdom_transition_login_userdomain(init_t)
 userdom_nnp_transition_login_userdomain(init_t)
 userdom_noatsecure_login_userdomain(init_t)
-- 
2.27.0