nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

various: make /etc/machine-id etc_runtime_t

Browse Source 
This file is updated at boot by systemd.

Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2023-03-06 10:14:55 -05:00
parent 064a66c509
commit 079de3d496
3 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/kernel/files.fc
View File

@ -53,6 +53,7 @@ ifdef(`distro_suse',`
/etc/ioctl\.save -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/killpower -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/localtime -l gen_context(system_u:object_r:etc_t,s0)
/etc/machine-id -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/mtab -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/mtab~[0-9]* -- gen_context(system_u:object_r:etc_runtime_t,s0)
/etc/mtab\.tmp -- gen_context(system_u:object_r:etc_runtime_t,s0)

2
policy/modules/services/dbus.te
View File

@ -191,6 +191,8 @@ ifdef(`init_systemd', `
dev_rw_dri(system_dbusd_t)
dev_rw_input_dev(system_dbusd_t)
files_read_etc_runtime_files(system_dbusd_t)
# for /run/systemd/dynamic-uid/
init_list_runtime(system_dbusd_t)
init_read_runtime_symlinks(system_dbusd_t)

6
policy/modules/system/systemd.te
View File

@ -489,6 +489,7 @@ dev_write_sysfs_dirs(systemd_generator_t)
dev_read_urand(systemd_generator_t)
files_read_etc_files(systemd_generator_t)
files_read_etc_runtime_files(systemd_generator_t)
files_search_runtime(systemd_generator_t)
files_list_boot(systemd_generator_t)
files_read_boot_files(systemd_generator_t)
@ -853,6 +854,7 @@ dev_setattr_video_dev(systemd_logind_t)
domain_obj_id_change_exemption(systemd_logind_t)
files_read_etc_runtime_files(systemd_logind_t)
files_search_runtime(systemd_logind_t)
# Getattr all shm segments as part of cleaning up the
# segments of deleted ephemeral users.
@ -1113,6 +1115,7 @@ dev_read_sysfs(systemd_networkd_t)
dev_write_kmsg(systemd_networkd_t)
files_read_etc_files(systemd_networkd_t)
files_read_etc_runtime_files(systemd_networkd_t)
files_watch_runtime_dirs(systemd_networkd_t)
files_watch_root_dirs(systemd_networkd_t)
files_list_runtime(systemd_networkd_t)
@ -1388,6 +1391,9 @@ dontaudit systemd_pcrphase_t self:capability net_admin;
dev_rw_tpm(systemd_pcrphase_t)
dev_write_kmsg(systemd_pcrphase_t)
# read /etc/machine-id
files_read_etc_runtime_files(systemd_pcrphase_t)
fs_read_efivarfs_files(systemd_pcrphase_t)
fs_getattr_cgroup(systemd_pcrphase_t)
fs_search_cgroup_dirs(systemd_pcrphase_t)