On 12/6/2024 10:22 PM, Russell Coker wrote:
What's this new pidfs that seems to have just become visible in 6.11.10 or similar recent kernels? https://lwn.net/Articles/714932/ The above article has some information about a previous iteration of it, apparently not a separate mountable filesystem but a part of /proc that can be mounted as part of a container. I'm seeing the following audit entries about it, what should we do in policy about this? type=AVC msg=audit(1733540968.538:31305): avc: denied { getattr } for pid=1465 comm="systemd" name="/" dev="pidfs" ino=1 scontext=etbe:user_r:user_systemd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=0
You should expect to see pidfds extensively with systemd processes, as the main systemd interfaces now use pidfds.
Right now the only option is to use a genfscon or task sid. I'd have preferred to improve the labeling behavior, but no kernel devs have had a chance to address it.
See https://github.com/SELinuxProject/refpolicy/pull/762 -- Chris
