RepoMirrors/selinux-refpolicy
1
0
Fork 0
mirror of https://github.com/SELinuxProject/refpolicy synced 2025-03-31 07:46:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

policykit devicekit: Add watch perms

Browse Source 
avc:  denied  { watch } for  pid=12488 comm="gmain" path="/etc" dev="zfs" ino=1436 scontext=system_u:system_r:devicekit_disk_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0
avc:  denied  { watch } for  pid=6452 comm="gmain" path="/run/ConsoleKit" dev="tmpfs" ino=17611 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:consolekit_runtime_t:s0 tclass=dir permissive=0
avc:  denied  { watch } for  pid=6452 comm="gmain" path="/usr/share/polkit-1/actions" dev="zfs" ino=235638 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0
avc:  denied  { watch } for  pid=6452 comm="gmain" path="/etc/polkit-1/rules.d" dev="zfs" ino=268215 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0
Signed-off-by: Jason Zaman <jason@perfinion.com>
This commit is contained in:
Jason Zaman 2020-02-17 04:03:15 +08:00 committed by Chris PeBenito
parent 9f8194fdf4
commit dd84b117e2
3 changed files with 22 additions and 0 deletions

18
policy/modules/services/consolekit.if
View File

@ -121,3 +121,21 @@ interface(`consolekit_read_pid_files',`
allow $1 consolekit_runtime_t:dir list_dir_perms;
read_files_pattern($1, consolekit_runtime_t, consolekit_runtime_t)
')
########################################
## <summary>
## Watch consolekit runtime dir.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`consolekit_watch_runtime_dir',`
gen_require(`
type consolekit_runtime_t;
')
allow $1 consolekit_runtime_t:dir watch;
')

1
policy/modules/services/devicekit.te
View File

@ -127,6 +127,7 @@ files_manage_boot_dirs(devicekit_disk_t)
files_manage_mnt_dirs(devicekit_disk_t)
files_read_etc_runtime_files(devicekit_disk_t)
files_read_usr_files(devicekit_disk_t)
files_watch_etc_dirs(devicekit_disk_t)
fs_getattr_all_fs(devicekit_disk_t)
fs_list_inotifyfs(devicekit_disk_t)

3
policy/modules/services/policykit.te
View File

@ -95,6 +95,8 @@ dev_read_urand(policykit_t)
domain_read_all_domains_state(policykit_t)
files_dontaudit_search_all_mountpoints(policykit_t)
files_watch_etc_dirs(policykit_t)
files_watch_usr_dirs(policykit_t)
fs_getattr_xattr_fs(policykit_t)
fs_list_inotifyfs(policykit_t)
@ -127,6 +129,7 @@ optional_policy(`
optional_policy(`
consolekit_read_pid_files(policykit_t)
consolekit_watch_runtime_dir(policykit_t)
')
optional_policy(`