2015-10-23 14:16:59 +00:00
|
|
|
## <summary>Systemd components (not PID 1)</summary>
|
|
|
|
|
|
2019-04-19 15:50:59 +00:00
|
|
|
#########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Template for systemd --user per-role domains.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="prefix">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Prefix for generated types
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
## <param name="role">
|
|
|
|
|
## <summary>
|
|
|
|
|
## The user role.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
## <param name="userdomain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## The user domain for the role.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
template(`systemd_role_template',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
attribute systemd_user_session_type, systemd_log_parse_env_type;
|
|
|
|
|
type systemd_user_runtime_t, systemd_user_runtime_notify_t;
|
2020-05-09 07:38:05 +00:00
|
|
|
type systemd_run_exec_t, systemd_analyze_exec_t;
|
2019-04-19 15:50:59 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
#
|
|
|
|
|
# Declarations
|
|
|
|
|
#
|
|
|
|
|
type $1_systemd_t, systemd_user_session_type, systemd_log_parse_env_type;
|
|
|
|
|
init_pgm_spec_user_daemon_domain($1_systemd_t)
|
|
|
|
|
domain_user_exemption_target($1_systemd_t)
|
|
|
|
|
ubac_constrained($1_systemd_t)
|
|
|
|
|
role $2 types $1_systemd_t;
|
|
|
|
|
|
|
|
|
|
#################################
|
|
|
|
|
#
|
|
|
|
|
# Local policy
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
allow $3 systemd_user_runtime_t:dir { manage_dir_perms relabel_dir_perms };
|
|
|
|
|
allow $3 systemd_user_runtime_t:file { manage_file_perms relabel_file_perms };
|
|
|
|
|
allow $3 systemd_user_runtime_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
|
|
|
|
|
allow $3 systemd_user_runtime_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
|
|
|
|
|
allow $3 systemd_user_runtime_t:sock_file { manage_sock_file_perms relabel_sock_file_perms };
|
|
|
|
|
|
|
|
|
|
allow $3 systemd_user_runtime_notify_t:sock_file { manage_sock_file_perms relabel_sock_file_perms };
|
|
|
|
|
|
|
|
|
|
# This domain is per-role because of the below transitions.
|
|
|
|
|
# See the sytemd --user section of systemd.te for the
|
|
|
|
|
# remainder of the rules.
|
|
|
|
|
allow $1_systemd_t $3:process { setsched rlimitinh };
|
|
|
|
|
corecmd_shell_domtrans($1_systemd_t, $3)
|
|
|
|
|
corecmd_bin_domtrans($1_systemd_t, $3)
|
systemd: allow user environment helpers to communicate with systemd --user
"systemd --user" spawns programs from
/usr/lib/systemd/user-environment-generators/ in order to gather
environment variables. On a Debian 10 virtual machine which gnupg, this
directory contains:
$ ls -Z /usr/lib/systemd/user-environment-generators
system_u:object_r:bin_t 30-systemd-environment-d-generator
system_u:object_r:bin_t 90gpg-agent
For sysadm, these programs are run as sysadm_t (because there is a
transition in systemd_role_template() in systemd.if:
corecmd_bin_domtrans($1_systemd_t, $3)) but use file descriptors created
by their parent process, which runs as sysadm_systemd_t. This leads to:
type=AVC msg=audit(1569756917.537:244): avc: denied { use } for
pid=9713 comm="30-systemd-envi"
path=2F6D656D66643A33302D73797374656D642D656E7669726F6E6D656E742D642D67656E657261746F72202864656C6574656429
dev="tmpfs" ino=24859 scontext=sysadm_u:sysadm_r:sysadm_t
tcontext=sysadm_u:sysadm_r:sysadm_systemd_t tclass=fd permissive=0
type=AVC msg=audit(1569756917.537:244): avc: denied { use } for
pid=9713 comm="30-systemd-envi"
path="/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator"
dev="vda1" ino=655822 scontext=sysadm_u:sysadm_r:sysadm_t
tcontext=sysadm_u:sysadm_r:sysadm_systemd_t tclass=fd permissive=0
type=SYSCALL msg=audit(1569756917.537:244): arch=c000003e syscall=59
success=no exit=-13 a0=5647d12cf020 a1=7ffc605b1fb0 a2=7ffc605b2420
a3=0 items=0 ppid=9712 pid=9713 auid=1000 uid=1000 gid=1000
euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000
tty=(none) ses=10 comm="30-systemd-envi"
exe="/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator"
subj=sysadm_u:sysadm_r:sysadm_t key=(null)
[...]
type=AVC msg=audit(1569756917.541:246): avc: denied { use } for
pid=9714 comm="90gpg-agent"
path=2F6D656D66643A39306770672D6167656E74202864656C6574656429
dev="tmpfs" ino=24860 scontext=sysadm_u:sysadm_r:sysadm_t
tcontext=sysadm_u:sysadm_r:sysadm_systemd_t tclass=fd permissive=0
type=AVC msg=audit(1569756917.541:246): avc: denied { use } for
pid=9714 comm="90gpg-agent" path="/usr/bin/bash" dev="vda1"
ino=524662 scontext=sysadm_u:sysadm_r:sysadm_t
tcontext=sysadm_u:sysadm_r:sysadm_systemd_t tclass=fd permissive=0
In systemd's source, here are the relevant functions:
* manager_run_environment_generators() calls execute_directories(paths,
DEFAULT_TIMEOUT_USEC, gather_environment, ...) [1], with
gather_environment a global table defined in exec-util.c [2]
* execute_directories() opens a "serialization fd" [3], that creates a
memfd for communication with the child processes [4].
* execute_directories() calls fork() and do_execute() [5] in order to
run each child process, providing them with the memfd descriptor in
order to gather their output.
* When a child process is executed, its context transitions from
sysadm_systemd_t to sysadm_t. The child then writes environment
variables to its output.
* The parent process (systemd --user) collects the environment variables
that have been written, and "consumes" the produced output in order to
override its environment variables.
[1] https://github.com/systemd/systemd/blob/v243/src/core/manager.c#L3836
[2] https://github.com/systemd/systemd/blob/v243/src/shared/exec-util.c#L413
[3] https://github.com/systemd/systemd/blob/v243/src/shared/exec-util.c#L213
[4] https://github.com/systemd/systemd/blob/v243/src/shared/serialize.c#L200
[5] https://github.com/systemd/systemd/blob/v243/src/shared/exec-util.c#L226
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-30 20:43:31 +00:00
|
|
|
|
|
|
|
|
# Allow using file descriptors for user environment generators
|
|
|
|
|
allow $3 $1_systemd_t:fd use;
|
2020-04-21 17:44:08 +00:00
|
|
|
|
2020-05-09 07:38:05 +00:00
|
|
|
can_exec($3, { systemd_run_exec_t systemd_analyze_exec_t })
|
2019-04-19 15:50:59 +00:00
|
|
|
')
|
|
|
|
|
|
2020-03-17 12:39:30 +00:00
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Make the specified type usable as a
|
|
|
|
|
## systemd generator
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Type to be used as a systemd generator type.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
## <param name="entry_point">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Type of the program to be used as an entry point to the generator domain.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_unit_generator',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
attribute systemd_generator_type;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
typeattribute $1 systemd_generator_type;
|
|
|
|
|
|
|
|
|
|
init_system_domain($1, $2)
|
|
|
|
|
')
|
|
|
|
|
|
2016-03-31 07:40:42 +00:00
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Make the specified type usable as an
|
|
|
|
|
## log parse environment type.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Type to be used as a log parse environment type.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_log_parse_environment',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
attribute systemd_log_parse_env_type;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
typeattribute $1 systemd_log_parse_env_type;
|
|
|
|
|
')
|
|
|
|
|
|
2020-01-15 20:46:40 +00:00
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to use systemd's Name Service Switch (NSS) module.
|
|
|
|
|
## This module provides UNIX user and group name resolution for dynamic users
|
|
|
|
|
## and groups allocated through the DynamicUser= option in systemd unit files
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_use_nss',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_conf_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
# Get attributes of /etc/systemd/dont-synthesize-nobody
|
|
|
|
|
files_search_etc($1)
|
|
|
|
|
allow $1 systemd_conf_t:file getattr;
|
|
|
|
|
|
|
|
|
|
optional_policy(`
|
|
|
|
|
dbus_system_bus_client($1)
|
|
|
|
|
# For GetDynamicUser(), LookupDynamicUserByName()... of org.freedesktop.systemd1.Manager
|
|
|
|
|
init_dbus_chat($1)
|
|
|
|
|
')
|
|
|
|
|
')
|
|
|
|
|
|
2019-08-29 18:05:29 +00:00
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to be used as a systemd service with a unit
|
|
|
|
|
## that uses PrivateDevices=yes in section [Service].
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_PrivateDevices',`
|
|
|
|
|
# For services using PrivateDevices, systemd mounts a dedicated
|
|
|
|
|
# tmpfs filesystem for the /dev, which gets label tmpfs_t.
|
|
|
|
|
# Allow to traverse /dev and to read symlinks in /dev (for example /dev/log)
|
|
|
|
|
fs_read_tmpfs_symlinks($1)
|
|
|
|
|
')
|
|
|
|
|
|
2018-06-08 00:17:15 +00:00
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to read udev hwdb file
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## domain allowed access
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_read_hwdb',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_hwdb_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
read_files_pattern($1, systemd_hwdb_t, systemd_hwdb_t)
|
|
|
|
|
')
|
|
|
|
|
|
2019-03-09 03:58:09 +00:00
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to map udev hwdb file
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## domain allowed access
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_map_hwdb',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_hwdb_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_hwdb_t:file map;
|
|
|
|
|
')
|
|
|
|
|
|
2015-10-23 14:16:59 +00:00
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Read systemd_login PID files.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_read_logind_pids',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_logind_runtime_t;
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
files_search_pids($1)
|
2019-09-08 20:55:02 +00:00
|
|
|
allow $1 systemd_logind_runtime_t:dir list_dir_perms;
|
|
|
|
|
allow $1 systemd_logind_runtime_t:file read_file_perms;
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Manage systemd_login PID pipes.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_manage_logind_pid_pipes',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_logind_runtime_t;
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
files_search_pids($1)
|
2019-09-08 20:55:02 +00:00
|
|
|
manage_fifo_files_pattern($1, systemd_logind_runtime_t, systemd_logind_runtime_t)
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
2017-04-06 21:37:50 +00:00
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Write systemd_login named pipe.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_write_logind_pid_pipes',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_logind_runtime_t;
|
2017-04-06 21:37:50 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
init_search_run($1)
|
|
|
|
|
files_search_pids($1)
|
2019-09-08 20:55:02 +00:00
|
|
|
allow $1 systemd_logind_runtime_t:fifo_file { getattr write };
|
2017-04-06 21:37:50 +00:00
|
|
|
')
|
|
|
|
|
|
2015-10-23 14:16:59 +00:00
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Use inherited systemd
|
|
|
|
|
## logind file descriptors.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_use_logind_fds',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_logind_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_logind_t:fd use;
|
|
|
|
|
')
|
|
|
|
|
|
2017-04-06 21:37:50 +00:00
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Read logind sessions files.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_read_logind_sessions_files',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_sessions_runtime_t, systemd_logind_t;
|
2017-04-06 21:37:50 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_logind_t:fd use;
|
|
|
|
|
init_search_run($1)
|
2019-09-08 20:55:02 +00:00
|
|
|
allow $1 systemd_sessions_runtime_t:dir list_dir_perms;
|
|
|
|
|
read_files_pattern($1, systemd_sessions_runtime_t, systemd_sessions_runtime_t)
|
2017-04-06 21:37:50 +00:00
|
|
|
')
|
|
|
|
|
|
2017-02-24 01:03:23 +00:00
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Write inherited logind sessions pipes.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_write_inherited_logind_sessions_pipes',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_logind_t, systemd_sessions_runtime_t;
|
2017-02-24 01:03:23 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_logind_t:fd use;
|
2019-09-08 20:55:02 +00:00
|
|
|
allow $1 systemd_sessions_runtime_t:fifo_file write;
|
2017-02-24 01:03:23 +00:00
|
|
|
allow systemd_logind_t $1:process signal;
|
|
|
|
|
')
|
|
|
|
|
|
2017-12-06 17:06:04 +00:00
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Write inherited logind inhibit pipes.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_write_inherited_logind_inhibit_pipes',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_logind_inhibit_runtime_t;
|
2017-12-06 17:06:04 +00:00
|
|
|
type systemd_logind_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_logind_t:fd use;
|
2019-09-08 20:55:02 +00:00
|
|
|
allow $1 systemd_logind_inhibit_runtime_t:fifo_file write;
|
2017-12-06 17:06:04 +00:00
|
|
|
')
|
|
|
|
|
|
2015-10-23 14:16:59 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Send and receive messages from
|
|
|
|
|
## systemd logind over dbus.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_dbus_chat_logind',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_logind_t;
|
|
|
|
|
class dbus send_msg;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_logind_t:dbus send_msg;
|
|
|
|
|
allow systemd_logind_t $1:dbus send_msg;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow process to write to systemd_kmod_conf_t.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
## <rolecap/>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_write_kmod_files',`
|
2017-02-18 21:16:30 +00:00
|
|
|
refpolicywarn(`$0($*) has been deprecated.')
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
2017-02-18 21:16:30 +00:00
|
|
|
########################################
|
2017-02-24 01:03:23 +00:00
|
|
|
## <summary>
|
2017-02-18 21:16:30 +00:00
|
|
|
## Get the system status information from systemd_login
|
2017-02-24 01:03:23 +00:00
|
|
|
## </summary>
|
2017-02-18 21:16:30 +00:00
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
2017-02-24 01:03:23 +00:00
|
|
|
## </param>
|
|
|
|
|
#
|
2017-02-18 21:16:30 +00:00
|
|
|
interface(`systemd_status_logind',`
|
2017-02-24 01:03:23 +00:00
|
|
|
gen_require(`
|
2017-02-18 21:16:30 +00:00
|
|
|
type systemd_logind_t;
|
|
|
|
|
class service status;
|
2017-02-24 01:03:23 +00:00
|
|
|
')
|
|
|
|
|
|
2017-02-18 21:16:30 +00:00
|
|
|
allow $1 systemd_logind_t:service status;
|
2017-02-24 01:03:23 +00:00
|
|
|
')
|
|
|
|
|
|
2015-10-23 14:16:59 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
2017-02-18 21:16:30 +00:00
|
|
|
## Send systemd_login a null signal.
|
2015-10-23 14:16:59 +00:00
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
2017-02-18 21:16:30 +00:00
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
2015-10-23 14:16:59 +00:00
|
|
|
## </param>
|
|
|
|
|
#
|
2017-02-18 21:16:30 +00:00
|
|
|
interface(`systemd_signull_logind',`
|
2015-10-23 14:16:59 +00:00
|
|
|
gen_require(`
|
2017-02-18 21:16:30 +00:00
|
|
|
type systemd_logind_t;
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
2017-02-18 21:16:30 +00:00
|
|
|
allow $1 systemd_logind_t:process signull;
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
2017-04-06 21:37:50 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow reading /run/systemd/machines
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain that can access the machines files
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_read_machines',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_machined_runtime_t;
|
2017-04-06 21:37:50 +00:00
|
|
|
')
|
|
|
|
|
|
2019-09-08 20:55:02 +00:00
|
|
|
allow $1 systemd_machined_runtime_t:dir list_dir_perms;
|
|
|
|
|
allow $1 systemd_machined_runtime_t:file read_file_perms;
|
2017-04-06 21:37:50 +00:00
|
|
|
')
|
|
|
|
|
|
2019-01-15 03:20:28 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Send and receive messages from
|
|
|
|
|
## systemd hostnamed over dbus.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_dbus_chat_hostnamed',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_hostnamed_t;
|
|
|
|
|
class dbus send_msg;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_hostnamed_t:dbus send_msg;
|
|
|
|
|
allow systemd_hostnamed_t $1:dbus send_msg;
|
|
|
|
|
')
|
|
|
|
|
|
2017-02-24 01:03:23 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## allow systemd_passwd_agent to inherit fds
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain that owns the fds
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_use_passwd_agent_fds',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_passwd_agent_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow systemd_passwd_agent_t $1:fd use;
|
|
|
|
|
')
|
|
|
|
|
|
2017-04-06 21:37:50 +00:00
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow a systemd_passwd_agent_t process to interact with a daemon
|
|
|
|
|
## that needs a password from the sysadmin.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_use_passwd_agent',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_passwd_agent_t;
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_passwd_runtime_t;
|
2017-04-06 21:37:50 +00:00
|
|
|
')
|
|
|
|
|
|
2019-09-08 20:55:02 +00:00
|
|
|
manage_files_pattern($1, systemd_passwd_runtime_t, systemd_passwd_runtime_t)
|
|
|
|
|
manage_sock_files_pattern($1, systemd_passwd_runtime_t, systemd_passwd_runtime_t)
|
2017-04-06 21:37:50 +00:00
|
|
|
|
|
|
|
|
allow systemd_passwd_agent_t $1:process signull;
|
2019-01-06 02:42:35 +00:00
|
|
|
ps_process_pattern(systemd_passwd_agent_t, $1)
|
2017-04-06 21:37:50 +00:00
|
|
|
allow systemd_passwd_agent_t $1:unix_dgram_socket sendto;
|
|
|
|
|
')
|
|
|
|
|
|
2017-02-24 01:03:23 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
2019-09-08 20:55:02 +00:00
|
|
|
## Transition to systemd_passwd_runtime_t when creating dirs
|
2017-02-24 01:03:23 +00:00
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_filetrans_passwd_runtime_dirs',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_passwd_runtime_t;
|
2017-02-24 01:03:23 +00:00
|
|
|
')
|
|
|
|
|
|
2019-09-08 20:55:02 +00:00
|
|
|
init_pid_filetrans($1, systemd_passwd_runtime_t, dir, "ask-password-block")
|
|
|
|
|
init_pid_filetrans($1, systemd_passwd_runtime_t, dir, "ask-password")
|
2017-02-24 01:03:23 +00:00
|
|
|
')
|
|
|
|
|
|
2017-04-16 23:48:04 +00:00
|
|
|
######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow to domain to create systemd-passwd symlink
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_manage_passwd_runtime_symlinks',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_passwd_runtime_t;
|
2017-04-16 23:48:04 +00:00
|
|
|
')
|
|
|
|
|
|
2019-09-08 20:55:02 +00:00
|
|
|
allow $1 systemd_passwd_runtime_t:lnk_file manage_lnk_file_perms;
|
2017-04-16 23:48:04 +00:00
|
|
|
')
|
|
|
|
|
|
2017-02-24 01:03:23 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
2020-05-08 17:54:48 +00:00
|
|
|
## manage systemd unit dirs and the files in them (Deprecated)
|
2017-02-24 01:03:23 +00:00
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_manage_all_units',`
|
2020-05-08 17:54:48 +00:00
|
|
|
refpolicywarn(`$0() has been deprecated, use init_manage_all_unit_files() instead.')
|
|
|
|
|
init_manage_all_unit_files($1)
|
2017-02-24 01:03:23 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
2019-01-20 21:36:36 +00:00
|
|
|
## Allow domain to read systemd_journal_t files
|
2017-02-24 01:03:23 +00:00
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
2019-01-20 21:36:36 +00:00
|
|
|
interface(`systemd_read_journal_files',`
|
2017-02-24 01:03:23 +00:00
|
|
|
gen_require(`
|
2017-02-24 01:16:40 +00:00
|
|
|
type systemd_journal_t;
|
2017-02-24 01:03:23 +00:00
|
|
|
')
|
|
|
|
|
|
2019-01-20 21:36:36 +00:00
|
|
|
list_dirs_pattern($1, systemd_journal_t, systemd_journal_t)
|
|
|
|
|
mmap_read_files_pattern($1, systemd_journal_t, systemd_journal_t)
|
2017-02-24 01:03:23 +00:00
|
|
|
')
|
|
|
|
|
|
2019-01-19 16:19:16 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
2019-01-20 21:36:36 +00:00
|
|
|
## Allow domain to create/manage systemd_journal_t files
|
2019-01-19 16:19:16 +00:00
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
2019-01-20 21:36:36 +00:00
|
|
|
interface(`systemd_manage_journal_files',`
|
2019-01-19 16:19:16 +00:00
|
|
|
gen_require(`
|
|
|
|
|
type systemd_journal_t;
|
|
|
|
|
')
|
|
|
|
|
|
2019-01-20 21:36:36 +00:00
|
|
|
manage_dirs_pattern($1, systemd_journal_t, systemd_journal_t)
|
|
|
|
|
manage_files_pattern($1, systemd_journal_t, systemd_journal_t)
|
|
|
|
|
allow $1 systemd_journal_t:file map;
|
2019-01-19 16:19:16 +00:00
|
|
|
')
|
2017-10-09 21:15:13 +00:00
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Relabel to systemd-journald directory type.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_relabelto_journal_dirs',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_journal_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
files_search_var($1)
|
|
|
|
|
allow $1 systemd_journal_t:dir relabelto_dir_perms;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Relabel to systemd-journald file type.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_relabelto_journal_files',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_journal_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
files_search_var($1)
|
|
|
|
|
list_dirs_pattern($1,systemd_journal_t,systemd_journal_t)
|
|
|
|
|
allow $1 systemd_journal_t:file relabelto_file_perms;
|
|
|
|
|
')
|
|
|
|
|
|
2017-10-11 14:59:08 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to read systemd_networkd_t unit files
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_read_networkd_units',`
|
|
|
|
|
gen_require(`
|
2020-01-16 13:39:36 +00:00
|
|
|
type systemd_networkd_unit_t;
|
2017-10-11 14:59:08 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
init_search_units($1)
|
|
|
|
|
list_dirs_pattern($1, systemd_networkd_unit_t, systemd_networkd_unit_t)
|
|
|
|
|
read_files_pattern($1, systemd_networkd_unit_t, systemd_networkd_unit_t)
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to create/manage systemd_networkd_t unit files
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_manage_networkd_units',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_networkd_unit_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
init_search_units($1)
|
|
|
|
|
manage_dirs_pattern($1, systemd_networkd_unit_t, systemd_networkd_unit_t)
|
|
|
|
|
manage_files_pattern($1, systemd_networkd_unit_t, systemd_networkd_unit_t)
|
|
|
|
|
')
|
|
|
|
|
|
2018-11-17 04:23:43 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow specified domain to enable systemd-networkd units
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_enabledisable_networkd',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_networkd_unit_t;
|
|
|
|
|
class service { enable disable };
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_networkd_unit_t:service { enable disable };
|
|
|
|
|
')
|
|
|
|
|
|
2017-10-11 14:59:08 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow specified domain to start systemd-networkd units
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_startstop_networkd',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_networkd_unit_t;
|
|
|
|
|
class service { start stop };
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_networkd_unit_t:service { start stop };
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow specified domain to get status of systemd-networkd
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_status_networkd',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_networkd_unit_t;
|
|
|
|
|
class service status;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_networkd_unit_t:service status;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Relabel systemd_networkd tun socket.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_relabelfrom_networkd_tun_sockets',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_networkd_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_networkd_t:tun_socket relabelfrom;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Read/Write from systemd_networkd netlink route socket.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_rw_networkd_netlink_route_sockets',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_networkd_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_networkd_t:netlink_route_socket client_stream_socket_perms;
|
|
|
|
|
')
|
|
|
|
|
|
2019-01-06 18:49:02 +00:00
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to list dirs under /run/systemd/netif
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## domain permitted the access
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_list_networkd_runtime',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_networkd_runtime_t;
|
2019-01-06 18:49:02 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
init_list_pids($1)
|
2019-09-08 20:55:02 +00:00
|
|
|
allow $1 systemd_networkd_runtime_t:dir list_dir_perms;
|
2019-01-06 18:49:02 +00:00
|
|
|
')
|
|
|
|
|
|
2020-01-08 15:51:11 +00:00
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Watch directories under /run/systemd/netif
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain permitted the access
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_watch_networkd_runtime_dirs',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_networkd_runtime_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_networkd_runtime_t:dir watch;
|
|
|
|
|
')
|
|
|
|
|
|
2018-06-06 14:25:07 +00:00
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to read files generated by systemd_networkd
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## domain allowed access
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
interface(`systemd_read_networkd_runtime',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_networkd_runtime_t;
|
2018-06-06 14:25:07 +00:00
|
|
|
')
|
|
|
|
|
|
2019-09-08 20:55:02 +00:00
|
|
|
list_dirs_pattern($1, systemd_networkd_runtime_t, systemd_networkd_runtime_t)
|
|
|
|
|
read_files_pattern($1, systemd_networkd_runtime_t, systemd_networkd_runtime_t)
|
2018-06-06 14:25:07 +00:00
|
|
|
')
|
2017-10-11 14:59:08 +00:00
|
|
|
|
2015-10-23 14:16:59 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
2017-02-19 21:13:14 +00:00
|
|
|
## Allow systemd_logind_t to read process state for cgroup file
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain systemd_logind_t may access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_read_logind_state',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_logind_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow systemd_logind_t $1:dir list_dir_perms;
|
|
|
|
|
allow systemd_logind_t $1:file read_file_perms;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
2017-02-18 21:16:30 +00:00
|
|
|
## Allow specified domain to start power units
|
2015-10-23 14:16:59 +00:00
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
2017-02-18 21:16:30 +00:00
|
|
|
## <summary>
|
|
|
|
|
## Domain to not audit.
|
|
|
|
|
## </summary>
|
2015-10-23 14:16:59 +00:00
|
|
|
## </param>
|
|
|
|
|
#
|
2017-02-18 21:16:30 +00:00
|
|
|
interface(`systemd_start_power_units',`
|
2015-10-23 14:16:59 +00:00
|
|
|
gen_require(`
|
2017-02-18 21:16:30 +00:00
|
|
|
type power_unit_t;
|
|
|
|
|
class service start;
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
2017-02-18 21:16:30 +00:00
|
|
|
allow $1 power_unit_t:service start;
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
2020-01-22 12:35:42 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Get the system status information about power units
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_status_power_units',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type power_unit_t;
|
|
|
|
|
class service status;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 power_unit_t:service status;
|
|
|
|
|
')
|
|
|
|
|
|
2015-10-23 14:16:59 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
2017-02-18 21:16:30 +00:00
|
|
|
## Make the specified type usable for
|
|
|
|
|
## systemd tmpfiles config files.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="type">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Type to be used for systemd tmpfiles config files.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
2017-09-08 15:41:56 +00:00
|
|
|
interface(`systemd_tmpfiles_conf_file',`
|
2017-02-18 21:16:30 +00:00
|
|
|
gen_require(`
|
|
|
|
|
attribute systemd_tmpfiles_conf_type;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
files_config_file($1)
|
|
|
|
|
typeattribute $1 systemd_tmpfiles_conf_type;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow the specified domain to create
|
|
|
|
|
## the tmpfiles config directory with
|
|
|
|
|
## the correct context.
|
2015-10-23 14:16:59 +00:00
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
2017-02-18 21:16:30 +00:00
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
2015-10-23 14:16:59 +00:00
|
|
|
## </param>
|
|
|
|
|
#
|
2017-02-18 21:16:30 +00:00
|
|
|
interface(`systemd_tmpfiles_creator',`
|
2015-10-23 14:16:59 +00:00
|
|
|
gen_require(`
|
2017-02-18 21:16:30 +00:00
|
|
|
type systemd_tmpfiles_conf_t;
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
2017-02-18 21:16:30 +00:00
|
|
|
files_pid_filetrans($1, systemd_tmpfiles_conf_t, dir, "tmpfiles.d")
|
|
|
|
|
allow $1 systemd_tmpfiles_conf_t:dir create;
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
2017-02-18 21:16:30 +00:00
|
|
|
## Create an object in the systemd tmpfiles config
|
|
|
|
|
## directory, with a private type
|
|
|
|
|
## using a type transition.
|
2015-10-23 14:16:59 +00:00
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
2017-02-18 21:16:30 +00:00
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
## <param name="private type">
|
|
|
|
|
## <summary>
|
|
|
|
|
## The type of the object to be created.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
## <param name="object">
|
|
|
|
|
## <summary>
|
|
|
|
|
## The object class of the object being created.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
## <param name="name" optional="true">
|
|
|
|
|
## <summary>
|
|
|
|
|
## The name of the object being created.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_tmpfiles_conf_filetrans',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_tmpfiles_conf_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
files_search_pids($1)
|
|
|
|
|
filetrans_pattern($1, systemd_tmpfiles_conf_t, $2, $3, $4)
|
|
|
|
|
')
|
|
|
|
|
|
2017-09-10 18:22:22 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to list systemd tmpfiles config directory
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_list_tmpfiles_conf',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_tmpfiles_conf_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_tmpfiles_conf_t:dir list_dir_perms;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to relabel to systemd tmpfiles config directory
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_relabelto_tmpfiles_conf_dirs',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_tmpfiles_conf_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_tmpfiles_conf_t:dir relabelto_dir_perms;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to relabel to systemd tmpfiles config files
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_relabelto_tmpfiles_conf_files',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
attribute systemd_tmpfiles_conf_type;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_tmpfiles_conf_type:file relabelto_file_perms;
|
|
|
|
|
')
|
|
|
|
|
|
2017-02-18 21:16:30 +00:00
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow systemd_tmpfiles_t to manage filesystem objects
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="type">
|
|
|
|
|
## <summary>
|
|
|
|
|
## type of object to manage
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
## <param name="class">
|
2015-10-23 14:16:59 +00:00
|
|
|
## <summary>
|
2017-02-18 21:16:30 +00:00
|
|
|
## object class to manage
|
2015-10-23 14:16:59 +00:00
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
2017-02-18 21:16:30 +00:00
|
|
|
interface(`systemd_tmpfilesd_managed',`
|
2015-10-23 14:16:59 +00:00
|
|
|
gen_require(`
|
2017-02-18 21:16:30 +00:00
|
|
|
type systemd_tmpfiles_t;
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
|
|
|
|
|
2017-02-18 21:16:30 +00:00
|
|
|
allow systemd_tmpfiles_t $1:$2 { setattr relabelfrom relabelto create };
|
2015-10-23 14:16:59 +00:00
|
|
|
')
|
2018-04-16 20:07:53 +00:00
|
|
|
|
2018-11-11 12:33:00 +00:00
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Send and receive messages from
|
|
|
|
|
## systemd resolved over dbus.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_dbus_chat_resolved',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_resolved_t;
|
|
|
|
|
class dbus send_msg;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_resolved_t:dbus send_msg;
|
|
|
|
|
allow systemd_resolved_t $1:dbus send_msg;
|
|
|
|
|
')
|
|
|
|
|
|
2018-04-16 20:07:53 +00:00
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to read resolv.conf file generated by systemd_resolved
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## domain allowed access
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_read_resolved_runtime',`
|
|
|
|
|
gen_require(`
|
2019-09-08 20:55:02 +00:00
|
|
|
type systemd_resolved_runtime_t;
|
2018-04-16 20:07:53 +00:00
|
|
|
')
|
|
|
|
|
|
2019-09-08 20:55:02 +00:00
|
|
|
read_files_pattern($1, systemd_resolved_runtime_t, systemd_resolved_runtime_t)
|
2018-04-16 20:07:53 +00:00
|
|
|
')
|
|
|
|
|
|
2018-06-07 19:19:41 +00:00
|
|
|
#######################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Allow domain to getattr on .updated file (generated by systemd-update-done
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## domain allowed access
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_getattr_updated_runtime',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
type systemd_update_run_t;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
getattr_files_pattern($1, systemd_update_run_t, systemd_update_run_t)
|
|
|
|
|
')
|
2019-04-19 15:50:59 +00:00
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Search keys for the all systemd --user domains.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_search_all_user_keys',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
attribute systemd_user_session_type;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_user_session_type:key search;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Create keys for the all systemd --user domains.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_create_all_user_keys',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
attribute systemd_user_session_type;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_user_session_type:key create;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
########################################
|
|
|
|
|
## <summary>
|
|
|
|
|
## Write keys for the all systemd --user domains.
|
|
|
|
|
## </summary>
|
|
|
|
|
## <param name="domain">
|
|
|
|
|
## <summary>
|
|
|
|
|
## Domain allowed access.
|
|
|
|
|
## </summary>
|
|
|
|
|
## </param>
|
|
|
|
|
#
|
|
|
|
|
interface(`systemd_write_all_user_keys',`
|
|
|
|
|
gen_require(`
|
|
|
|
|
attribute systemd_user_session_type;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
allow $1 systemd_user_session_type:key write;
|
|
|
|
|
')
|
