With systemd-logind: journald reading logind session files denied

[dtmuller]

Hi.

I'm using refpolicy 2.20250213 and systemd 257.4 from Yocto Walnascar.

When running systemd-logind I get denials for journald reading logind session files:

type=AVC msg=audit(1764847985.438:60): avc:  denied  { read } for  pid=728 comm="systemd-journal" name="sessions" dev="tmpfs" ino=816 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:systemd_sessions_runtime_t:s0 tclass=dir permissive=0
type=AVC msg=audit(1764847989.924:68): avc:  denied  { read } for  pid=728 comm="systemd-journal" name="sessions" dev="tmpfs" ino=816 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:systemd_sessions_runtime_t:s0 tclass=dir permissive=0

I can fix those by adding to logging.te:

systemd_read_logind_sessions_files(syslogd_t)

Could you please verify and if applicable add this rule?

Thanks,
Daniel

[21sw-clayton]

@yizhao1

[yizhao1]

Hello, could you please provide more details? For example, POLICY_TYPE, MACHINE, and other additional settings in conf/local.conf? I can not reproduce it with the default settings.

[dtmuller]

I'm using POLICY_TYPE = mcs with MACHINE = qemux86-64. There are no special settings in local.conf apart from EXTRA_IMAGE_FEATURES += "debug-tweaks package-management tools-debug".

[yizhao1]

I am still unable to reproduce this issue using core-image-selinux image on the latest yocto walnascar branch (I've tried on both qemux86-64 and genericx86-64). If you have confirmed this is a bug, perhaps you could submit a PR directly.