nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fs, udev: allow systemd-udevd various cgroup perms

Browse Source 
Needed for systemd-udevd to create files under
/sys/fs/cgroup/system.slice/systemd-udevd.service/udev

Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2023-03-06 13:18:41 -05:00
parent dea2090ac3
commit 02e558be0f
2 changed files with 44 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
policy/modules/kernel/filesystem.if
View File

@ -798,7 +798,6 @@ interface(`fs_getattr_cgroup',`
interface(`fs_search_cgroup_dirs',`
gen_require(`
type cgroup_t;
')
search_dirs_pattern($1, cgroup_t, cgroup_t)
@ -843,6 +842,25 @@ interface(`fs_ioctl_cgroup_dirs', `
dev_search_sysfs($1)
')
########################################
## <summary>
## Create cgroup directories.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`fs_create_cgroup_dirs',`
gen_require(`
type cgroup_t;
')
create_dirs_pattern($1, cgroup_t, cgroup_t)
dev_search_sysfs($1)
')
########################################
## <summary>
## Delete cgroup directories.
@ -941,6 +959,26 @@ interface(`fs_read_cgroup_files',`
dev_search_sysfs($1)
')
########################################
## <summary>
## Create cgroup files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`fs_create_cgroup_files',`
gen_require(`
type cgroup_t;
')
create_files_pattern($1, cgroup_t, cgroup_t)
dev_search_sysfs($1)
')
########################################
## <summary>
## Watch cgroup files.

6
policy/modules/system/udev.te
View File

@ -261,7 +261,11 @@ ifdef(`distro_redhat',`
ifdef(`init_systemd',`
files_search_kernel_modules(udev_t)
fs_read_cgroup_files(udev_t)
# systemd-udev creates cgroup files under
# /sys/fs/cgroup/system.slice/systemd-udevd.service/udev
fs_create_cgroup_dirs(udev_t)
fs_create_cgroup_files(udev_t)
fs_rw_cgroup_files(udev_t)
init_dgram_send(udev_t)
init_get_generic_units_status(udev_t)