diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index b4803770e..42de367d7 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -1472,6 +1472,26 @@ interface(`files_manage_non_auth_files',` files_manage_kernel_modules($1) ') +######################################## +## +## Mmap non-authentication related +## files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`files_map_non_auth_files',` + gen_require(` + attribute non_auth_file_type; + ') + + allow $1 non_auth_file_type:file map; +') + ######################################## ## ## Relabel all non-authentication related diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index bc0cd2f4f..a7c89e723 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -1233,6 +1233,7 @@ template(`userdom_admin_user_template',` auth_getattr_shadow($1_t) # Manage almost all files files_manage_non_auth_files($1_t) + files_map_non_auth_files($1_t) # Relabel almost all files files_relabel_non_auth_files($1_t)