https://bugzilla.redhat.com/show_bug.cgi?id=1550595
--- Comment #16 from Javier Martinez Canillas fmartine@redhat.com --- (In reply to dac.override from comment #15)
it should be clarified because it is questionable.
If a "system_dbusd_domain" would need this permission then the permission would have been enclosed with "system_dbusd_domain()"
Looking at https://github.com/tpm2-software/tpm2-abrmd/commit/51a3c55d772b it seems that this file descriptor gets passed to dbusd
So at least now that part is explained.
ideally the dbusd.if header would have exported an "dbus_rw_inherited_system_unix_stream_sockets()" interface for you to call, but there is not so just change line:
https://github.com/tpm2-software/tpm2-abrmd/blob/1.x/selinux/tabrmd.te#L20
to look like:
allow system_dbusd_t tabrmd_t:unix_stream_socket { read write};
Optionally add a comment: # TODO: add to dbus.if: dbus_rw_inherited_system_unix_stream_sockets() and call that instead
I will, thanks again!