/run/credentials

Does anyone have any policy for credentials?  

Below is what I'm getting on my systems running Debian/Testing, directories 
like the following with no files in them.

# find /run/credentials/
/run/credentials/
/run/credentials/[email protected]
/run/credentials/systemd-resolved.service
/run/credentials/systemd-journald.service
# find /run/credentials/ -type f
# 

Currently what is happening is daemons trying to read their own dir and being 
denied, here's an example:

type=AVC msg=audit(1783593117.796:143): avc:  denied  { open } for  pid=1034 
comm="agetty" path="/run/credentials/[email protected]" dev="tmpfs" ino=1 
scontext=system_u:system_r:getty_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 
tclass=dir permissive=1

I was thinking of adding a credentials_runtime_t type and labelling everything 
under /run/credentials with it, giving daemons read-access to directories and 
wait to write real policy until people make daemons actually use it.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/