Description of problem: Version-Release number of selected component (if applicable): systemd-194-2 selinux-policy-3.11.1-41.fc18 How reproducible: 100% Steps to Reproduce: [root@systemd ~]# systemctl mask masked.service ln -s '/dev/null' '/etc/systemd/system/masked.service' [root@systemd ~]# systemctl status masked.service Failed to issue method call: Access denied Actual results: Failed to issue method call: Access denied Expected results: masked.service Loaded: masked (/dev/null) Active: inactive (dead) Additional info: from audit.log type=USER_AVC msg=audit(1350729865.689:57): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { status } for auid=0 uid=0 gid=0 path="/dev/null" cmdline="systemctl status masked.service" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:null_device_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
Dan, how about your systemd fix for this issue?
Actually I missed ln -s '/dev/null' '/etc/systemd/system/masked.service'
So you can "disable" a service which you want this way, right?
I am not quite sure what you are asking, but you use mask in the case that you don't want the service to start under any circumstances.
(In reply to comment #4) > I am not quite sure what you are asking, but you use mask in the case that > you don't want the service to start under any circumstances. Yes, it was my question. Dan, what do you think about that?
I think we should add interfaces for this and obviously unconfined_t should be allowed to do it.
I added this to f06014decd66106ec2c82e7229db4f27758db80b
Ok, Fixed in selinux-policy-3.11.1-44.fc18
selinux-policy-3.11.1-46.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-46.fc18
Package selinux-policy-3.11.1-46.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-46.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-16862/selinux-policy-3.11.1-46.fc18 then log in and leave karma (feedback).
selinux-policy-3.11.1-46.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.