Failed to grant selinux permission for ioctl

1
votes

I got following selinux permission issues:

[ 35.353551] type=1400 audit(38.680:14): avc: denied { ioctl } for pid=266 comm="multilink" path="socket:[12798]" dev="sockfs" ino=12798 ioctlcmd=0x8946 scontext=u:r:multilink:s0 tcontext=u:r:multilink:s0 tclass=socket permissive=1

[ 35.353789] type=1400 audit(38.680:16): avc: denied { ioctl } for pid=266 comm="multilink" path="socket:[12799]" dev="sockfs" ino=12799 ioctlcmd=0x8933 scontext=u:r:multilink:s0 tcontext=u:r:multilink:s0 tclass=packet_socket permissive=1

I tried to add following rules to fix this issue:

allowxperm multilink self:socket ioctl SIOCETHTOOL;

allowxperm multilink self:packet_socket ioctl SIOCGIFINDEX;

But, it didn't work, same issues occurred again.

Do I miss something ?

1
ioctlselinux

1 Answers

1
votes

Adding another rule will fix this issue:

allow multilink self:socket { create ioctl };

allow multilink self:packet_socket { create ioctl };