RepoMirrors/selinux-refpolicy
1
0
Fork 0
mirror of https://github.com/SELinuxProject/refpolicy synced 2025-03-11 07:40:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request from PPN-SD/upd-knot-sel

Browse Source 
Add setcap to knotd / add knotc_initrc_domtrans
This commit is contained in:
Chris PeBenito 2025-03-03 09:53:09 -05:00 committed by GitHub
commit da9a30ff66
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 20 additions and 1 deletions
policy/modules/services
knot.ifknot.te

19
policy/modules/services/knot.if
View File

@ -45,6 +45,25 @@ interface(`knot_run_client',`
roleattribute $2 knot_roles;
')
########################################
## <summary>
## Execute knotc in knot init
## scripts in the initrc domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`knotc_initrc_domtrans',`
gen_require(`
type knot_initrc_exec_t;
')
init_labeled_script_domtrans($1, knot_initrc_exec_t)
')
########################################
## <summary>
## Read knot config files.

2
policy/modules/services/knot.te
View File

@ -38,7 +38,7 @@ files_type(knot_var_lib_t)
#
allow knotd_t self:capability { dac_override dac_read_search setgid setpcap setuid };
allow knotd_t self:process { getcap getsched setsched signal_perms };
allow knotd_t self:process { getcap getsched setcap setsched signal_perms };
allow knotd_t self:tcp_socket create_stream_socket_perms;
allow knotd_t self:udp_socket create_socket_perms;
allow knotd_t self:unix_stream_socket create_stream_socket_perms;