diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index 41346fb6c..e9514027b 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -5606,6 +5606,26 @@ interface(`files_list_locks',` list_dirs_pattern($1, var_t, var_lock_t) ') +######################################## +## +## Create lock directories +## +## +## +## Domain allowed access +## +## +# +interface(`files_create_lock_dirs',` + gen_require(` + type var_t, var_lock_t; + ') + + allow $1 var_t:dir search_dir_perms; + allow $1 var_lock_t:lnk_file read_lnk_file_perms; + create_dirs_pattern($1, var_lock_t, var_lock_t) +') + ######################################## ## ## Add and remove entries in the /var/lock @@ -5626,6 +5646,24 @@ interface(`files_rw_lock_dirs',` rw_dirs_pattern($1, var_t, var_lock_t) ') +######################################## +## +## Set the attributes of the generic lock directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`files_setattr_lock_dirs',` + gen_require(` + type var_t, var_lock_t; + ') + + setattr_dirs_pattern($1, var_t, var_lock_t) +') + ######################################## ## ## Relabel to and from all lock directory types. @@ -6014,6 +6052,29 @@ interface(`files_pid_filetrans',` filetrans_pattern($1, var_run_t, $2, $3, $4) ') +######################################## +## +## Create a generic lock directory within the run directories +## +## +## +## Domain allowed access +## +## +## +## +## The name of the object being created. +## +## +# +interface(`files_pid_filetrans_lock_dir',` + gen_require(` + type var_lock_t; + ') + + files_pid_filetrans($1, var_lock_t, dir, $2) +') + ######################################## ## ## Read and write generic process ID files.