Re: systemd and dontaudit

Russell Coker <[email protected]> writes:

> On Wednesday, 23 July 2025 22:37:09 AEST Chris PeBenito wrote:
>> On 7/22/2025 8:15 PM, Russell Coker wrote:
>> > kernel_dontaudit_getattr_proc(systemd_logind_t)
>> > 
>> > The above hides the fact that systemd-logind wants to statfs /proc and
>> > that
>> > can cause it to abort in some situations, to refuse to respond to dbus
>> > requests, and to delay all logins by 25 seconds.
>> 
>> Can you elaborate on what one of those failing situations is?
>
> It only happened repeatedly on one of my systems.  I think that triggering 
> that particular condition required multiple settings, so just not allowing 
> statfs isn't necessarily enough, some other combination of things allowed and 
> denied seemed necessary to get it into that state. The one system that had 
> this had it persist across reboots but other systems never had it.  I had seen 
> it briefly happen on other systems but a reboot fixed it.
>
> I didn't put as much effort into investigating this as I might have because 
> the access in question is fairly innocuous.

I suspect this is triggered by libcap-ng's init function:
https://github.com/stevegrubb/libcap-ng/blob/master/src/cap-ng.c#L236

-- 
gpg --locate-keys [email protected] (wkd)
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @[email protected]