diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index 4a8d1465f..c22a7fbf3 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -261,7 +261,7 @@ optional_policy(` ') optional_policy(` - raid_domtrans_mdadm(sysadm_t) + raid_run_mdadm(sysadm_r, sysadm_t) ') optional_policy(` diff --git a/policy/modules/system/raid.if b/policy/modules/system/raid.if index c817fda71..893a34152 100644 --- a/policy/modules/system/raid.if +++ b/policy/modules/system/raid.if @@ -47,3 +47,28 @@ interface(`raid_manage_mdadm_pid',` # mdadm policy allow $1 mdadm_var_run_t:file manage_file_perms; ') + +###################################### +## +## Execute a domain transition to mdadm_t for the +## specified role, allowing it to use the mdadm_t +## domain +## +## +## +## Role allowed to access mdadm_t domain +## +## +## +## +## Domain allowed to transition to mdadm_t +## +## +# +interface(`raid_run_mdadm',` + gen_require(` + type mdadm_t; + ') + role $1 types mdadm_t; + raid_domtrans_mdadm($2) +')