RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

systemd: introduce an interface for services using PrivateDevices=yes 

When a service is configured with PrivateDevices=yes, its /dev directory
has label tmpfs_t. This requires allowing more accesses in order for the
service to use /dev.

This is related to https://github.com/SELinuxProject/refpolicy/pull/61

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
This commit is contained in:
Nicolas Iooss 2019-08-29 20:05:29 +02:00
parent 0b2ab72127
commit a7e3407606
No known key found for this signature in database
GPG Key ID: C191415F340DAAA0
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
policy/modules/system/systemd.if
View File

@ -76,6 +76,24 @@ interface(`systemd_log_parse_environment',`
typeattribute $1 systemd_log_parse_env_type;
')
######################################
## <summary>
## Allow domain to be used as a systemd service with a unit
## that uses PrivateDevices=yes in section [Service].
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access
## </summary>
## </param>
#
interface(`systemd_PrivateDevices',`
# For services using PrivateDevices, systemd mounts a dedicated
# tmpfs filesystem for the /dev, which gets label tmpfs_t.
# Allow to traverse /dev and to read symlinks in /dev (for example /dev/log)
fs_read_tmpfs_symlinks($1)
')
#######################################
## <summary>
## Allow domain to read udev hwdb file