RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

systemd: allow regular users to run systemd-analyze 

Same deal as with systemd-run this is potentially useful for non
privileged users and especially useful for admins.

Signed-off-by: bauen1 <j2468h@gmail.com>
This commit is contained in:
bauen1 2020-05-09 09:38:05 +02:00
parent e7dad518eb
commit 0ff1f78619
No known key found for this signature in database
GPG Key ID: FF0AAF5E0812BA9C
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policy/modules/system/systemd.if
View File

@ -24,7 +24,7 @@ template(`systemd_role_template',`
gen_require(` gen_require(`
attribute systemd_user_session_type, systemd_log_parse_env_type; attribute systemd_user_session_type, systemd_log_parse_env_type;
type systemd_user_runtime_t, systemd_user_runtime_notify_t; type systemd_user_runtime_t, systemd_user_runtime_notify_t;
type systemd_run_exec_t; type systemd_run_exec_t, systemd_analyze_exec_t;
') ')
################################# #################################
@ -60,7 +60,7 @@ template(`systemd_role_template',`
# Allow using file descriptors for user environment generators # Allow using file descriptors for user environment generators
allow $3 $1_systemd_t:fd use; allow $3 $1_systemd_t:fd use;
can_exec($3, systemd_run_exec_t) can_exec($3, { systemd_run_exec_t systemd_analyze_exec_t })
') ')
###################################### ######################################