Re: denied { allowed }

On Sat, 23 May 2026 at 03:52, Russell Coker <[email protected]> wrote:
>
> Why do we have a permission named "allowed"?  The syscall is io_uring_setup so
> surely "setup" would be a reasonable permission name.
>
> "allowed" gives no indication of what the permission is actually for and
> results in confusing log entries and policy.

I disliked it as well, but was too late [1].

[1]: https://lore.kernel.org/selinux/CAHC9VhRUzr2XpfP5XJpXLxEhYoFvtee8OgEwvib1x7+H7B68Qg@mail.gmail.com/

>
> /var/log/audit/audit.log.1:type=AVC msg=audit(1779420151.752:71961): avc:
> denied  { allowed } for  pid=866175 comm="dig"
> scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=io_uring
> permissive=0
> /var/log/audit/audit.log.1:type=SYSCALL msg=audit(1779420151.752:71961):
> arch=c000003e syscall=425 success=no exit=-13 a0=100 a1=7ffc066fd1f0 a2=0 a3=c
> items=0 ppid=866150 pid=866175 auid=1027 uid=1027 gid=1028 euid=1027 suid=1027
> fsuid=1027 egid=1028 sgid=1028 fsgid=1028 tty=pts1 ses=2320 comm="dig" exe="/
> usr/bin/dig" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> key=(null)ARCH=x86_64 SYSCALL=io_uring_setup AUID="yifei" UID="yifei"
> GID="yifei" EUID="yifei" SUID="yifei" FSUID="yifei" EGID="yifei" SGID="yifei"
> FSGID="yifei"
>
> --
> My Main Blog         http://etbe.coker.com.au/
> My Documents Blog    http://doc.coker.com.au/
>
>
>
>