diff --git a/policy/modules/apps/screen.if b/policy/modules/apps/screen.if index 884e261a9..6b0826811 100644 --- a/policy/modules/apps/screen.if +++ b/policy/modules/apps/screen.if @@ -90,3 +90,22 @@ template(`screen_role_template',` fs_nfs_domtrans($1_screen_t, $3) ') ') + +######################################## +## +## Execute the screen runtime sock file. +## +## +## +## Domain allowed access. +## +## +interface(`screen_execute_sock_file',` + gen_require(` + type screen_tmp_t; + type screen_runtime_t; + ') + + allow $1 screen_runtime_t:sock_file execute; + allow $1 screen_tmp_t:dir search; +')