RepoMirrors/selinux-refpolicy
1
0
Fork 0
mirror of https://github.com/SELinuxProject/refpolicy synced 2025-03-30 07:16:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

init: Add support for systemd StandardInputText.

Browse Source 
This normally uses memfd which uses posix shm under the hood.
Additionally, a direct shm use is a fallback if memfd is not available.

Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
This commit is contained in:
Chris PeBenito 2021-05-06 10:30:11 -04:00
parent cd783138ac
commit 2e1c1c6240
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
policy/modules/system/init.if
View File

@ -183,9 +183,17 @@ interface(`init_domain',`
allow init_t $1:process rlimitinh;
ifdef(`init_systemd',`
gen_require(`
type init_tmpfs_t;
')
allow $1 init_t:unix_stream_socket { getattr read write ioctl };
allow init_t $1:process2 { nnp_transition nosuid_transition };
# StandardInputText uses a memfd rw shm segment.
# Cannot deny writes or it breaks.
allow $1 init_tmpfs_t:file rw_inherited_file_perms;
')
')
@ -270,9 +278,17 @@ interface(`init_spec_daemon_domain',`
allow init_t $1:process rlimitinh;
ifdef(`init_systemd',`
gen_require(`
type init_tmpfs_t;
')
allow $1 init_t:unix_stream_socket { getattr read write ioctl };
allow init_t $1:process2 { nnp_transition nosuid_transition };
# StandardInputText uses a memfd rw shm segment.
# Cannot deny writes or it breaks.
allow $1 init_tmpfs_t:file rw_inherited_file_perms;
')
# daemons started from init will

8
policy/modules/system/init.te
View File

@ -112,6 +112,9 @@ files_type(initrc_state_t)
type initrc_tmp_t;
files_tmp_file(initrc_tmp_t)
type init_tmpfs_t;
files_tmpfs_file(init_tmpfs_t)
type initrc_var_log_t;
logging_log_file(initrc_var_log_t)
@ -170,6 +173,9 @@ files_runtime_filetrans(init_t, initctl_t, fifo_file)
# Modify utmp.
allow init_t initrc_runtime_t:file { rw_file_perms setattr };
allow init_t init_tmpfs_t:file manage_file_perms;
fs_tmpfs_filetrans(init_t, init_tmpfs_t, file)
kernel_read_system_state(init_t)
kernel_share_state(init_t)
kernel_dontaudit_search_unlabeled(init_t)
@ -292,8 +298,6 @@ ifdef(`init_systemd',`
manage_lnk_files_pattern(init_t, init_runtime_t, init_runtime_t)
manage_sock_files_pattern(init_t, init_runtime_t, init_runtime_t)
manage_dirs_pattern(init_t, init_runtime_t, init_runtime_t)
# /memfd:systemd-state
fs_tmpfs_filetrans(init_t, init_runtime_t, file)
# mounton is required for systemd-timesyncd
allow init_t init_var_lib_t:dir { manage_dir_perms mounton };