diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc index 673d222be..626914a20 100644 --- a/policy/modules/system/systemd.fc +++ b/policy/modules/system/systemd.fc @@ -87,6 +87,7 @@ HOME_DIR/\.local/share/systemd(/.*)? gen_context(system_u:object_r:systemd_data /var/lib/systemd/coredump(/.*)? gen_context(system_u:object_r:systemd_coredump_var_lib_t,s0) /var/lib/systemd/home(/.*)? gen_context(system_u:object_r:systemd_homed_var_lib_t,s0) /var/lib/systemd/linger(/.*)? gen_context(system_u:object_r:systemd_logind_var_lib_t,s0) +/var/lib/systemd/network(/.*)? gen_context(system_u:object_r:systemd_networkd_var_lib_t,s0) /var/lib/systemd/pstore(/.*)? gen_context(system_u:object_r:systemd_pstore_var_lib_t,s0) /var/lib/systemd/rfkill(/.*)? gen_context(system_u:object_r:systemd_rfkill_var_lib_t,s0) diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index 67ed3294b..d6a7ced2a 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -212,6 +212,9 @@ init_mountpoint(systemd_networkd_runtime_t) type systemd_networkd_unit_t; init_unit_file(systemd_networkd_unit_t) +type systemd_networkd_var_lib_t; +files_type(systemd_networkd_var_lib_t) + type systemd_notify_t; type systemd_notify_exec_t; init_daemon_domain(systemd_notify_t, systemd_notify_exec_t) @@ -1241,6 +1244,10 @@ manage_dirs_pattern(systemd_networkd_t, systemd_networkd_runtime_t, systemd_netw manage_files_pattern(systemd_networkd_t, systemd_networkd_runtime_t, systemd_networkd_runtime_t) manage_lnk_files_pattern(systemd_networkd_t, systemd_networkd_runtime_t, systemd_networkd_runtime_t) +init_var_lib_filetrans(systemd_networkd_t, systemd_networkd_var_lib_t, dir) +manage_dirs_pattern(systemd_networkd_t, systemd_networkd_var_lib_t, systemd_networkd_var_lib_t) +manage_files_pattern(systemd_networkd_t, systemd_networkd_var_lib_t, systemd_networkd_var_lib_t) + kernel_read_system_state(systemd_networkd_t) kernel_read_kernel_sysctls(systemd_networkd_t) kernel_read_network_state(systemd_networkd_t)