RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

systemd: add extra systemd_generator_t rules 

Fixes:

avc:  denied  { setfscreate } for  pid=41 comm="systemd-getty-g"
scontext=system_u:system_r:systemd_generator_t
tcontext=system_u:system_r:systemd_generator_t tclass=process
permissive=1

avc:  denied  { dac_override } for  pid=40 comm="systemd-fstab-g"
capability=1  scontext=system_u:system_r:systemd_generator_t
tcontext=system_u:system_r:systemd_generator_t tclass=capability
permissive=1

Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
This commit is contained in:
Antoine Tenart 2020-08-13 11:52:20 +02:00
parent f99b6907f4
commit f71d288e54
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/system/systemd.te
View File

@ -362,6 +362,8 @@ seutil_search_default_contexts(systemd_coredump_t)
# #
allow systemd_generator_t self:fifo_file rw_fifo_file_perms; allow systemd_generator_t self:fifo_file rw_fifo_file_perms;
allow systemd_generator_t self:capability dac_override;
allow systemd_generator_t self:process setfscreate;
corecmd_getattr_bin_files(systemd_generator_t) corecmd_getattr_bin_files(systemd_generator_t)