diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if index 16a96ec77..8be5a1d6d 100644 --- a/policy/modules/kernel/terminal.if +++ b/policy/modules/kernel/terminal.if @@ -149,6 +149,24 @@ interface(`term_mount_devpts',` allow $1 devpts_t:filesystem mount; ') +######################################## +## +## Create directory /dev/pts. +## +## +## +## The type of the process creating the directory. +## +## +# +interface(`term_create_devpts',` + gen_require(` + type devpts_t; + ') + + allow $1 devpts_t:dir create_dir_perms; +') + ######################################## ## ## Create a pty in the /dev/pts directory. diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index bdb0d6c86..c6d230456 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -323,6 +323,8 @@ ifdef(`init_systemd',` systemd_manage_passwd_runtime_symlinks(init_t) systemd_use_passwd_agent(init_t) + term_create_devpts(init_t) + # udevd is a "systemd kobject uevent socket activated daemon" udev_create_kobject_uevent_sockets(init_t)