selinux-refpolicy/policy/modules/system/systemd.if

193 lines
3.8 KiB
Plaintext

## <summary>Systemd components (not PID 1)</summary>
######################################
## <summary>
## Make the specified type usable as an
## log parse environment type.
## </summary>
## <param name="domain">
## <summary>
## Type to be used as a log parse environment type.
## </summary>
## </param>
#
interface(`systemd_log_parse_environment',`
gen_require(`
attribute systemd_log_parse_env_type;
')
typeattribute $1 systemd_log_parse_env_type;
')
######################################
## <summary>
## Read systemd_login PID files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_read_logind_pids',`
gen_require(`
type systemd_logind_var_run_t;
')
files_search_pids($1)
read_files_pattern($1, systemd_logind_var_run_t, systemd_logind_var_run_t)
')
######################################
## <summary>
## Manage systemd_login PID pipes.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_manage_logind_pid_pipes',`
gen_require(`
type systemd_logind_var_run_t;
')
files_search_pids($1)
manage_fifo_files_pattern($1, systemd_logind_var_run_t, systemd_logind_var_run_t)
')
######################################
## <summary>
## Use inherited systemd
## logind file descriptors.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_use_logind_fds',`
gen_require(`
type systemd_logind_t;
')
allow $1 systemd_logind_t:fd use;
')
########################################
## <summary>
## Send and receive messages from
## systemd logind over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_dbus_chat_logind',`
gen_require(`
type systemd_logind_t;
class dbus send_msg;
')
allow $1 systemd_logind_t:dbus send_msg;
allow systemd_logind_t $1:dbus send_msg;
')
########################################
## <summary>
## Allow process to write to systemd_kmod_conf_t.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`systemd_write_kmod_files',`
gen_require(`
type systemd_kmod_conf_t;
')
write_files_pattern($1, var_run_t, systemd_kmod_conf_t)
')
########################################
## <summary>
## Allow process to relabel to systemd_kmod_conf_t.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`systemd_relabelto_kmod_files',`
gen_require(`
type systemd_kmod_conf_t;
')
allow $1 systemd_kmod_conf_t:file relabelto_file_perms;
')
########################################
## <summary>
## Get the system status information from systemd_login
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_status_logind',`
gen_require(`
type systemd_logind_t;
class service status;
')
allow $1 systemd_logind_t:service status;
')
########################################
## <summary>
## Send systemd_login a null signal.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_signull_logind',`
gen_require(`
type systemd_logind_t;
')
allow $1 systemd_logind_t:process signull;
')
########################################
## <summary>
## Allow specified domain to start power units
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`systemd_start_power_units',`
gen_require(`
type power_unit_t;
class service start;
')
allow $1 power_unit_t:service start;
')