Re: pidfs

On 12/6/2024 10:22 PM, Russell Coker wrote:
> What's this new pidfs that seems to have just become visible in 6.11.10 or
> similar recent kernels?
> 
> https://lwn.net/Articles/714932/
> 
> The above article has some information about a previous iteration of it,
> apparently not a separate mountable filesystem but a part of /proc that can be
> mounted as part of a container.
> 
> I'm seeing the following audit entries about it, what should we do in policy
> about this?
> 
> type=AVC msg=audit(1733540968.538:31305): avc:  denied  { getattr } for
> pid=1465 comm="systemd" name="/" dev="pidfs" ino=1
> scontext=etbe:user_r:user_systemd_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=0

You should expect to see pidfds extensively with systemd processes, as 
the main systemd interfaces now use pidfds.

Right now the only option is to use a genfscon or task sid.  I'd have 
preferred to improve the labeling behavior, but no kernel devs have had 
a chance to address it.

See https://github.com/SELinuxProject/refpolicy/pull/762

--
Chris