Allow systemd-ask-password to watch files

On systems that use plymouth, systemd-ask-password may set watches on
the contents on /run/systemd/ask-password, whereas other scenarions only
set watch on the parent directory.

Signed-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com>
This commit is contained in:
Daniel Burgener 2020-12-11 18:22:42 +00:00
parent c8c418267d
commit b3204ea4c1
1 changed files with 1 additions and 1 deletions

View File

@ -1020,7 +1020,7 @@ allow systemd_passwd_agent_t self:capability { chown sys_tty_config dac_override
allow systemd_passwd_agent_t self:process { setfscreate setsockcreate signal };
allow systemd_passwd_agent_t self:unix_dgram_socket create_socket_perms;
allow systemd_passwd_agent_t systemd_passwd_var_run_t:dir watch;
allow systemd_passwd_agent_t systemd_passwd_var_run_t:{ dir file } watch;
manage_dirs_pattern(systemd_passwd_agent_t, systemd_passwd_runtime_t, systemd_passwd_runtime_t)
manage_files_pattern(systemd_passwd_agent_t, systemd_passwd_runtime_t, systemd_passwd_runtime_t)
manage_sock_files_pattern(systemd_passwd_agent_t, systemd_passwd_runtime_t, systemd_passwd_runtime_t)