From 0e8bfe529e31cb3583fbee933b27a85d5d7f7abc Mon Sep 17 00:00:00 2001 From: Khalid Faisal Ansari Date: Tue, 30 Jun 2026 12:37:59 +0530 Subject: [PATCH] tpm2: fix tpm2-abrmd D-Bus communication under enforcing mode tpm2-abrmd was crashing on every activation attempt under SELinux enforcing mode, causing all tpm2-tools commands to fall back to direct TPM device access with a GDBus warning. AVC analysis showed the root denial: avc: denied { read write } for comm="dbus-daemon" scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:system_r:tpm2_abrmd_t:s0 tclass=unix_stream_socket permissive=0 tpm2-abrmd uses socketpair(PF_LOCAL, SOCK_STREAM) to create a connected fd pair for each client connection, then passes one end to dbus-daemon via SCM_RIGHTS (D-Bus fd-passing). dbus-daemon needs { read write } on the inherited anonymous socket to relay TPM commands between the client and tpm2-abrmd. This is not a connectto operation -- the socket is already connected when the fd is received. policy/modules/services/tpm2.if: - Add tpm2_rw_abrmd_stream_sockets() interface granting rw_socket_perms on tpm2_abrmd_t:unix_stream_socket, used by system_dbusd_t to read/write the socketpair fds passed by abrmd. policy/modules/services/dbus.te: - Call tpm2_rw_abrmd_stream_sockets(system_dbusd_t) inside the existing optional_policy block alongside tpm2_rw_abrmd_pipes(). policy/modules/services/tpm2.te: - Add files_read_etc_files(tpm2_abrmd_t) for D-Bus config reading. - Add miscfiles_read_localization(tpm2_abrmd_t) for GLib locale init. - Add init_dbus_chat(tpm2_abrmd_t) for Type=dbus systemd activation. policy/modules/system/unconfined.te: - Add tpm2_dbus_chat_abrmd(unconfined_t) in an optional_policy block. policy/modules/roles/sysadm.te: - Add tpm2_run(sysadm_t, sysadm_r) and tpm2_dbus_chat_abrmd(sysadm_t) so the sysadm role can run tpm2-tools and communicate with tpm2-abrmd. Upstream-Status: Submitted Tested-by: Khalid Faisal Ansari Signed-off-by: Khalid Faisal Ansari --- policy/modules/roles/sysadm.te | 5 +++++ policy/modules/services/dbus.te | 1 + policy/modules/services/tpm2.if | 20 ++++++++++++++++++++ policy/modules/services/tpm2.te | 5 +++++ policy/modules/system/unconfined.te | 4 ++++ 5 files changed, 35 insertions(+) diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index 3a82425685..3c5048609e 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -1147,6 +1147,11 @@ optional_policy(` tor_admin(sysadm_t, sysadm_r) ') +optional_policy(` + tpm2_run(sysadm_t, sysadm_r) + tpm2_dbus_chat_abrmd(sysadm_t) +') + optional_policy(` transproxy_admin(sysadm_t, sysadm_r) ') diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te index 2c78514386..a10ec91b45 100644 --- a/policy/modules/services/dbus.te +++ b/policy/modules/services/dbus.te @@ -305,6 +305,7 @@ optional_policy(` optional_policy(` tpm2_rw_abrmd_pipes(system_dbusd_t) + tpm2_rw_abrmd_stream_sockets(system_dbusd_t) ') optional_policy(` diff --git a/policy/modules/services/tpm2.if b/policy/modules/services/tpm2.if index 2ed89eab50..583318c1aa 100644 --- a/policy/modules/services/tpm2.if +++ b/policy/modules/services/tpm2.if @@ -224,3 +224,23 @@ interface(`tpm2_rw_abrmd_pipes',` allow $1 tpm2_abrmd_t:fd use; allow $1 tpm2_abrmd_t:fifo_file rw_fifo_file_perms; ') + +######################################## +## +## Read and write tpm2-abrmd unix stream sockets. +## This is used by the D-Bus system daemon to communicate +## over the socketpair fds passed by tpm2-abrmd to clients. +## +## +## +## Domain allowed access. +## +## +# +interface(`tpm2_rw_abrmd_stream_sockets',` + gen_require(` + type tpm2_abrmd_t; + ') + allow $1 tpm2_abrmd_t:fd use; + allow $1 tpm2_abrmd_t:unix_stream_socket rw_socket_perms; +') diff --git a/policy/modules/services/tpm2.te b/policy/modules/services/tpm2.te index b908e66323..1a487738e3 100644 --- a/policy/modules/services/tpm2.te +++ b/policy/modules/services/tpm2.te @@ -33,8 +33,13 @@ logging_send_syslog_msg(tpm2_abrmd_t) dev_read_urand(tpm2_abrmd_t) +files_read_etc_files(tpm2_abrmd_t) + +miscfiles_read_localization(tpm2_abrmd_t) + optional_policy(` dbus_system_domain(tpm2_abrmd_t, tpm2_abrmd_exec_t) + init_dbus_chat(tpm2_abrmd_t) ') diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te index 1c98f5e852..27d6874a60 100644 --- a/policy/modules/system/unconfined.te +++ b/policy/modules/system/unconfined.te @@ -274,6 +274,10 @@ optional_policy(` allow unconfined_execmem_t self:process { execmem execstack }; unconfined_domain_noaudit(unconfined_execmem_t) +optional_policy(` + tpm2_dbus_chat_abrmd(unconfined_t) +') + optional_policy(` unconfined_dbus_chat(unconfined_execmem_t) ')