Commit Graph

20 Commits

Author SHA1 Message Date
Nicolas Iooss 60382e9e53 init: allow systemd to relabel /dev and /run
systemd relabels everything in /dev and /run after loading the policy.
In these directories there is a socket file for udev, /run/udev/control,
which is not allowed to be relabelled from tmpfs_t:

    avc:  denied  { relabelfrom } for  pid=1 comm="systemd"
    name="control" dev="tmpfs" ino=7027
    scontext=system_u:system_r:init_t tcontext=system_u:object_r:tmpfs_t
    tclass=sock_file permissive=1

    avc:  denied  { relabelto } for  pid=1 comm="systemd" name="control"
    dev="tmpfs" ino=7027 scontext=system_u:system_r:init_t
    tcontext=system_u:object_r:udev_var_run_t tclass=sock_file
    permissive=1

/run/tmpfiles.d directory (used by systemd-tmpfiles service) is also
relabelled.
2017-09-11 20:03:31 -04:00
Chris PeBenito b49d85c83d misc daemons from Russell Coker.
Put in libx32 subs entries that refer to directories with fc entries.

Allow dpkg_t to transition to dpkg_script_t when it executes bin_t for
dpkg-reconfigure.

Some dontaudit rules for mta processes spawned by mon for notification.

Lots of tiny changes that are obvious.
2017-04-18 20:38:13 -04:00
Chris PeBenito b411e4b300 another version of systemd cgroups hostnamed and logind
From Russell Coker
2017-03-25 13:45:37 -04:00
Chris PeBenito 2087bde934 Systemd fixes from Russell Coker. 2017-02-23 20:03:23 -05:00
Chris PeBenito 3639880cf6 Implement core systemd policy.
Significant contributions from the Tresys CLIP team.

Other changes from Laurent Bigonville.
2015-10-23 10:16:59 -04:00
Laurent Bigonville bc40d90816 udev.if: Call files_search_pid instead of files_search_var_lib in udev_manage_pid_files
udev_manage_pid_files is supposed to manage files that are located in
/var/run, allow to search files in this directory instead of /var/lib
2013-01-23 07:09:05 -05:00
Chris PeBenito 1673ea6474 Rearrange interfaces in files, clock, and udev. 2012-10-30 14:16:30 -04:00
Dominick Grift 1cbe9e6196 For svirt_lxc_domain
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2012-10-30 13:58:01 -04:00
Chris PeBenito 61c65fe602 Rearrange interfaces in files.if and udev.if. 2012-07-24 08:55:52 -04:00
Chris PeBenito bd4ea4cdc0 Whitespace fixes in udev.if. 2012-07-24 08:52:21 -04:00
Sven Vermeulen 486e700352 Prepare udev interfaces for /run usage
Recent udev implementations now use /run (actually, /run/udev) for storing
database files, rules and more. Hence, we need to extend existing interfaces to
support searching through the udev_var_run_t location (as most of that was
previously only in device_t and/or etc_t or udev_etc_t)

Next to enhancing the interfaces, we provide additional ones that will be used
by the init script (for udev) which needs to create and support the new
/run/udev locations.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-07-24 08:42:31 -04:00
Dominick Grift a0546c9d1c System layer xml fixes.
Signed-off-by: Dominick Grift <domg472@gmail.com>
2010-08-05 09:25:55 -04:00
Chris PeBenito e2c9450235 Remove excessive permission in udev_manage_rules_files() and move the interface up in the .if file. Module version bump for d56b33a. 2010-05-18 10:28:17 -04:00
Chris Richards d56b33a1e4 Create new interface and type for managing /etc/udev/rules.d
udev_var_run_t is used for managing files in /etc/udev/rules.d as well as other files, including udev pid files.  This patch creates a type specifically for rules.d files, and an interface for managing them.  It also gives access to this type to initrc_t so that rules can be properly populated during startup.  This also fixes a problem on Gentoo where udev rules are NOT properly populated on startup.

Signed-off-by: Chris Richards <gizmo@giz-works.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2010-05-18 10:20:55 -04:00
Chris PeBenito 402bbb9fe9 Improve documentation of udev_read_db(). 2010-03-03 14:16:36 -05:00
Chris PeBenito 837163cfe7 UDEV patch from Dan Walsh. 2009-11-25 09:44:14 -05:00
Chris PeBenito 153fe24bdc trunk: 5 patches from dan. 2009-04-07 14:09:43 +00:00
Chris PeBenito 3c9b2e9bc6 trunk: 6 patches from dan. 2009-03-19 17:56:10 +00:00
Chris PeBenito c0868a7a3b merge policy patterns to trunk 2006-12-12 20:08:08 +00:00
Chris PeBenito 17de1b790b remove extra level of directory 2006-07-12 20:32:27 +00:00