Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Allow init create and use vsock sockets
Required after the following systemd change: The system manager manager will now parse a new "vmm.notify_socket" system credential, which may be supplied to a VM via SMBIOS. If found, the manager will send a "READY=1" notification on the specified socket after boot is complete. This allows readiness notification to be sent from a VM guest to the VM host over a VSOCK socket. The commit addresses the following AVC denials: Oct 05 12:20:55 fedora audit[1]: AVC avc: denied { create } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=vsock_socket permissive=1 Oct 05 12:20:55 fedora audit[1]: AVC avc: denied { bind } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=vsock_socket permissive=1 Oct 05 12:20:55 fedora audit[1]: AVC avc: denied { connect } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=vsock_socket permissive=1 Oct 05 12:20:55 fedora audit[1]: AVC avc: denied { getopt } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=vsock_socket permissive=1 Oct 05 12:20:55 fedora audit[1]: AVC avc: denied { setopt } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=vsock_socket permissive=1
- Loading branch information