Skip to content

fix(guestos): allow systemd-resolved to connect to networkd's resolve-hook socket #11413

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
basvandijk merged 1 commit into from
Sep 2, 2026
Merged

fix(guestos): allow systemd-resolved to connect to networkd's resolve-hook socket #11413

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions ic-os/components/guestos/selinux/systemd-fixes/systemd-fixes.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,14 @@ require_read_proc_sys_kernel(systemd_detect_virt_t)
require_read_efivarfs_files(systemd_resolved_t)
# it wants to read certificates
miscfiles_read_generic_certs(systemd_resolved_t)
# systemd-resolved connects to systemd-networkd's varlink "resolve hook"
# socket (/run/systemd/resolve.hook/io.systemd.Network) to obtain per-link DNS
# configuration. When this is denied, resolved logs "Failed to connect to
# resolve.hook: Permission denied" and can end up without any DNS servers for
# the lifetime of the boot ("Failed to start query: Permission denied" for
# every lookup), which for example makes the orchestrator unable to download
# GuestOS upgrade images.
allow systemd_resolved_t systemd_networkd_t : unix_stream_socket { connectto };

###############################################################################
# systemd-cryptsetup
Expand Down
Loading