[freeipa PR#5994][opened] selinux policy: allow custodia to access /proc/cpuinfo

[flo-renaud]

   URL: https://github.com/freeipa/freeipa/pull/5994
Author: flo-renaud
 Title: #5994: selinux policy: allow custodia to access /proc/cpuinfo
Action: opened

PR body:
"""
On aarch64, custodia creates AVC when accessing /proc/cpuinfo.

According to gcrypt manual
(https://gnupg.org/documentation/manuals/gcrypt/Configuration.html),
/proc/cpuinfo is used on ARM architecture to read the hardware
capabilities of the CPU. This explains why the issue happens only
on aarch64.

audit2allow suggests to add the following:
allow ipa_custodia_t proc_t:file { getattr open read };

but this policy would be too broad. Instead, the patch is using
the interface kernel_read_system_state.

Fixes: https://pagure.io/freeipa/issue/8972
Signed-off-by: Florence Blanc-Renaud <flo(a)redhat.com&gt;
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5994/head:pr5994
git checkout pr5994

[freeipa PR#5994][closed] selinux policy: allow custodia to access /proc/cpuinfo

[flo-renaud]

   URL: https://github.com/freeipa/freeipa/pull/5994
Author: flo-renaud
 Title: #5994: selinux policy: allow custodia to access /proc/cpuinfo
Action: closed

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5994/head:pr5994
git checkout pr5994