RepoMirrors/selinux-refpolicy
1
0
Fork 0
mirror of https://github.com/SELinuxProject/refpolicy synced 2025-03-11 07:40:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add setcap to knotd / add knotc_initrc_domtrans

Browse Source 
allow capabilities as it's the default behavior now

allow knotc cmd in init script: knotc conf-check (by default)

Signed-off-by: Nicolas PARLANT <nicolas.parlant@parhuet.fr>
This commit is contained in:
Nicolas PARLANT 2025-03-01 23:00:20 +00:00
parent badb91ce49
commit b025e0ec4f
No known key found for this signature in database
GPG Key ID: B336A0566553B5D5
2 changed files with 20 additions and 1 deletions
policy/modules/services
knot.ifknot.te

19
policy/modules/services/knot.if
View File

@ -45,6 +45,25 @@ interface(`knot_run_client',`
roleattribute $2 knot_roles;
')
########################################
## <summary>
## Execute knotc in knot init
## scripts in the initrc domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`knotc_initrc_domtrans',`
gen_require(`
type knot_initrc_exec_t;
')
init_labeled_script_domtrans($1, knot_initrc_exec_t)
')
########################################
## <summary>
## Read knot config files.

2
policy/modules/services/knot.te
View File

@ -38,7 +38,7 @@ files_type(knot_var_lib_t)
#
allow knotd_t self:capability { dac_override dac_read_search setgid setpcap setuid };
allow knotd_t self:process { getcap getsched setsched signal_perms };
allow knotd_t self:process { getcap getsched setcap setsched signal_perms };
allow knotd_t self:tcp_socket create_stream_socket_perms;
allow knotd_t self:udp_socket create_socket_perms;
allow knotd_t self:unix_stream_socket create_stream_socket_perms;