tree 59e89b3ca1c5afa6cc3fb246c6f236594e4ef4a6
parent 096fb209120164d95c7046009ee24600fdb0eb43
author Maurizio Lombardi <mlombard@redhat.com> 1708007983 +0100
committer Vegard Nossum <vegard.nossum@oracle.com> 1717417792 +0000

scsi: target: Fix SELinux error when systemd-modules loads the target module

[ Upstream commit 97a54ef596c3fd24ec2b227ba8aaf2cf5415e779 ]

If the systemd-modules service loads the target module, the credentials of
that userspace process will be used to validate the access to the target db
directory.  SELinux will prevent it, reporting an error like the following:

kernel: audit: type=1400 audit(1676301082.205:4): avc: denied  { read }
for  pid=1020 comm="systemd-modules" name="target" dev="dm-3"
ino=4657583 scontext=system_u:system_r:systemd_modules_load_t:s0
tcontext=system_u:object_r:targetd_etc_rw_t:s0 tclass=dir permissive=0

Fix the error by using the kernel credentials to access the db directory

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Link: https://lore.kernel.org/r/20240215143944.847184-2-mlombard@redhat.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 2c9cb7a564bdd454df694b8e08eecbf925199eac)
[Vegard: remove target_init_dbroot() call due to missing commit
 78a6295c71cb276f8ab0bfc786f3543a4e756a8f ("scsi: target: prefer dbroot
 of /etc/target over /var/target").]
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>