diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if index 06e47f356..7ec52e8a5 100644 --- a/policy/modules/system/systemd.if +++ b/policy/modules/system/systemd.if @@ -81,11 +81,6 @@ template(`systemd_role_template',` allow $1_systemd_t $3:file read_file_perms; allow $1_systemd_t $3:lnk_file read_lnk_file_perms; - filetrans_pattern(systemd_user_session_type, systemd_user_runtime_t, systemd_user_runtime_unit_t, dir, "generator.early") - filetrans_pattern(systemd_user_session_type, systemd_user_runtime_t, systemd_user_runtime_unit_t, dir, "generator.late") - filetrans_pattern(systemd_user_session_type, systemd_user_runtime_t, systemd_user_runtime_unit_t, dir, "transient") - filetrans_pattern(systemd_user_session_type, systemd_user_runtime_t, systemd_user_runtime_unit_t, dir, "user") - dev_read_urand($1_systemd_t) files_search_home($1_systemd_t) diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index dd83cdd56..3bb25c6b5 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -1524,6 +1524,11 @@ userdom_user_runtime_filetrans(systemd_user_session_type, systemd_user_runtime_t allow systemd_user_session_type systemd_user_runtime_notify_t:sock_file create; type_transition systemd_user_session_type systemd_user_runtime_t:sock_file systemd_user_runtime_notify_t "notify"; +filetrans_pattern(systemd_user_session_type, systemd_user_runtime_t, systemd_user_runtime_unit_t, dir, "generator.early") +filetrans_pattern(systemd_user_session_type, systemd_user_runtime_t, systemd_user_runtime_unit_t, dir, "generator.late") +filetrans_pattern(systemd_user_session_type, systemd_user_runtime_t, systemd_user_runtime_unit_t, dir, "transient") +filetrans_pattern(systemd_user_session_type, systemd_user_runtime_t, systemd_user_runtime_unit_t, dir, "user") + allow systemd_user_session_type systemd_user_tmpfs_t:file manage_file_perms; fs_tmpfs_filetrans(systemd_user_session_type, systemd_user_tmpfs_t, file)