diff --git a/policy/modules/admin/logrotate.te b/policy/modules/admin/logrotate.te index 826ce03ff..39e921135 100644 --- a/policy/modules/admin/logrotate.te +++ b/policy/modules/admin/logrotate.te @@ -188,7 +188,7 @@ optional_policy(` optional_policy(` dbus_system_bus_client(logrotate_t) - init_write_pid_socket(logrotate_t) + init_write_runtime_socket(logrotate_t) ') optional_policy(` diff --git a/policy/modules/apps/userhelper.te b/policy/modules/apps/userhelper.te index bffbc94c6..3e6ea63f0 100644 --- a/policy/modules/apps/userhelper.te +++ b/policy/modules/apps/userhelper.te @@ -149,7 +149,7 @@ auth_search_pam_console_data(userhelper_type) init_use_fds(userhelper_type) init_manage_utmp(userhelper_type) -init_pid_filetrans_utmp(userhelper_type) +init_runtime_filetrans_utmp(userhelper_type) logging_send_syslog_msg(userhelper_type) diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if index 5beb21e97..9abb94703 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -2691,6 +2691,22 @@ interface(`init_relabel_utmp',` ## # interface(`init_pid_filetrans_utmp',` + refpolicywarn(`$0($*) has been deprecated, please use init_runtime_filetrans_utmp() instead.') + init_runtime_filetrans_utmp($1) +') + +######################################## +## +## Create files in /var/run with the +## utmp file type. +## +## +## +## Domain allowed access. +## +## +# +interface(`init_runtime_filetrans_utmp',` gen_require(` type initrc_var_run_t; ') @@ -2709,6 +2725,21 @@ interface(`init_pid_filetrans_utmp',` ## # interface(`init_create_pid_dirs',` + refpolicywarn(`$0($*) has been deprecated, please use init_create_runtime_dirs() instead.') + init_create_runtime_dirs($1) +') + +####################################### +## +## Create a directory in the /run/systemd directory. +## +## +## +## Domain allowed access. +## +## +# +interface(`init_create_runtime_dirs',` gen_require(` type init_var_run_t; ') @@ -2728,6 +2759,21 @@ interface(`init_create_pid_dirs',` ## # interface(`init_rename_pid_files',` + refpolicywarn(`$0($*) has been deprecated, please use init_rename_runtime_files() instead.') + init_rename_runtime_files($1) +') + +######################################## +## +## Rename init_var_run_t files +## +## +## +## domain +## +## +# +interface(`init_rename_runtime_files',` gen_require(` type init_var_run_t; ') @@ -2737,7 +2783,7 @@ interface(`init_rename_pid_files',` ######################################## ## -## Rename and de init_var_run_t files +## Delete init_var_run_t files ## ## ## @@ -2746,6 +2792,21 @@ interface(`init_rename_pid_files',` ## # interface(`init_delete_pid_files',` + refpolicywarn(`$0($*) has been deprecated, please use init_delete_runtime_files() instead.') + init_delete_runtime_files($1) +') + +######################################## +## +## Delete init_var_run_t files +## +## +## +## domain +## +## +# +interface(`init_delete_runtime_files',` gen_require(` type init_var_run_t; ') @@ -2765,6 +2826,22 @@ interface(`init_delete_pid_files',` ## # interface(`init_write_pid_socket',` + refpolicywarn(`$0($*) has been deprecated, please use init_write_runtime_socket() instead.') + init_write_runtime_socket($1) +') + +####################################### +## +## Allow the specified domain to write to +## init sock file. +## +## +## +## Domain allowed access. +## +## +# +interface(`init_write_runtime_socket',` gen_require(` type init_var_run_t; ') @@ -2783,6 +2860,21 @@ interface(`init_write_pid_socket',` ## # interface(`init_read_pid_pipes',` + refpolicywarn(`$0($*) has been deprecated, please use init_read_runtime_pipes() instead.') + init_read_runtime_pipes($1) +') + +######################################## +## +## Read init unnamed pipes. +## +## +## +## Domain allowed access. +## +## +# +interface(`init_read_runtime_pipes',` gen_require(` type init_var_run_t; ') diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index cfa220f00..462b5116d 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -1372,7 +1372,7 @@ ifdef(`init_systemd',` fs_search_cgroup_dirs(daemon) # need write to /var/run/systemd/notify - init_write_pid_socket(daemon) + init_write_runtime_socket(daemon) ') tunable_policy(`init_daemons_use_tty',` diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index c3cf0738d..98a63ef8b 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -544,13 +544,13 @@ ifdef(`init_systemd',` domain_getattr_all_domains(syslogd_t) domain_read_all_domains_state(syslogd_t) - init_create_pid_dirs(syslogd_t) + init_create_runtime_dirs(syslogd_t) init_daemon_pid_file(syslogd_var_run_t, dir, "syslogd") init_getattr(syslogd_t) - init_rename_pid_files(syslogd_t) - init_delete_pid_files(syslogd_t) + init_rename_runtime_files(syslogd_t) + init_delete_runtime_files(syslogd_t) init_dgram_send(syslogd_t) - init_read_pid_pipes(syslogd_t) + init_read_runtime_pipes(syslogd_t) init_read_runtime_symlinks(syslogd_t) init_read_state(syslogd_t) diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index f5f7dc1bd..04f642f53 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -305,7 +305,7 @@ selinux_getattr_fs(systemd_coredump_t) init_list_var_lib_dirs(systemd_coredump_t) init_read_state(systemd_coredump_t) init_search_pids(systemd_coredump_t) -init_write_pid_socket(systemd_coredump_t) +init_write_runtime_socket(systemd_coredump_t) logging_send_syslog_msg(systemd_coredump_t) @@ -752,7 +752,7 @@ init_getrlimit(systemd_nspawn_t) init_kill_scripts(systemd_nspawn_t) init_read_state(systemd_nspawn_t) init_search_run(systemd_nspawn_t) -init_write_pid_socket(systemd_nspawn_t) +init_write_runtime_socket(systemd_nspawn_t) init_spec_domtrans_script(systemd_nspawn_t) miscfiles_manage_localization(systemd_nspawn_t) @@ -847,8 +847,8 @@ term_read_console(systemd_passwd_agent_t) auth_use_nsswitch(systemd_passwd_agent_t) -init_create_pid_dirs(systemd_passwd_agent_t) -init_read_pid_pipes(systemd_passwd_agent_t) +init_create_runtime_dirs(systemd_passwd_agent_t) +init_read_runtime_pipes(systemd_passwd_agent_t) init_read_state(systemd_passwd_agent_t) init_read_utmp(systemd_passwd_agent_t) init_stream_connect(systemd_passwd_agent_t)