scsi: target: Fix SELinux error when systemd-modules loads the target module
authorMaurizio Lombardi <mlombard@redhat.com>
Thu, 15 Feb 2024 14:39:43 +0000 (15:39 +0100)
committerMartin K. Petersen <martin.petersen@oracle.com>
Sat, 6 Apr 2024 01:37:54 +0000 (21:37 -0400)
commit97a54ef596c3fd24ec2b227ba8aaf2cf5415e779
treed381038173f7a8000bc17ed533f9b3567058a628
parentd4e655c49f474deffaf5ed7e65034b8167ee39c8
scsi: target: Fix SELinux error when systemd-modules loads the target module

If the systemd-modules service loads the target module, the credentials of
that userspace process will be used to validate the access to the target db
directory.  SELinux will prevent it, reporting an error like the following:

kernel: audit: type=1400 audit(1676301082.205:4): avc: denied  { read }
for  pid=1020 comm="systemd-modules" name="target" dev="dm-3"
ino=4657583 scontext=system_u:system_r:systemd_modules_load_t:s0
tcontext=system_u:object_r:targetd_etc_rw_t:s0 tclass=dir permissive=0

Fix the error by using the kernel credentials to access the db directory

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Link: https://lore.kernel.org/r/20240215143944.847184-2-mlombard@redhat.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/target/target_core_configfs.c