nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

files, systemd: allow systemd-tmpfiles to relabel config file symlinks

Browse Source 
Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2023-03-06 13:37:02 -05:00
parent eed80c888c
commit 716f47dbd5
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
policy/modules/kernel/files.if
View File

@ -1711,6 +1711,25 @@ interface(`files_dontaudit_relabel_config_files',`
dontaudit $1 configfile:file relabel_file_perms; dontaudit $1 configfile:file relabel_file_perms;
') ')
#######################################
## <summary>
## Relabel configuration symlinks.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
##
#
interface(`files_relabel_config_symlinks',`
gen_require(`
attribute configfile;
')
relabel_lnk_files_pattern($1, configfile, configfile)
')
######################################## ########################################
## <summary> ## <summary>
## Mount a filesystem on all mount points. ## Mount a filesystem on all mount points.

3
policy/modules/system/systemd.te
View File

@ -1677,8 +1677,9 @@ files_manage_all_locks(systemd_tmpfiles_t)
files_purge_tmp(systemd_tmpfiles_t) files_purge_tmp(systemd_tmpfiles_t)
files_read_etc_files(systemd_tmpfiles_t) files_read_etc_files(systemd_tmpfiles_t)
files_read_etc_runtime_files(systemd_tmpfiles_t) files_read_etc_runtime_files(systemd_tmpfiles_t)
files_relabel_config_files(systemd_tmpfiles_t)
files_relabel_config_dirs(systemd_tmpfiles_t) files_relabel_config_dirs(systemd_tmpfiles_t)
files_relabel_config_files(systemd_tmpfiles_t)
files_relabel_config_symlinks(systemd_tmpfiles_t)
files_relabel_all_locks(systemd_tmpfiles_t) files_relabel_all_locks(systemd_tmpfiles_t)
files_relabel_all_runtime_dirs(systemd_tmpfiles_t) files_relabel_all_runtime_dirs(systemd_tmpfiles_t)
files_relabel_all_tmp_dirs(systemd_tmpfiles_t) files_relabel_all_tmp_dirs(systemd_tmpfiles_t)