nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

systemd_tmpfiles_t: Allow systemd_tempfiles_t to change permissions in sysfs

Browse Source 
Rules specified in system tmpfiles.d configuration files are often used to
change permissions on files in sysfs.

https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html

Signed-off-by: Peter Morrow <pemorrow@linux.microsoft.com>
This commit is contained in:
Peter Morrow 2020-02-05 15:47:47 +00:00
parent d7f3567e4d
commit 8872d607b7
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
policy/modules/kernel/devices.if
View File

@ -4395,6 +4395,26 @@ interface(`dev_relabel_all_sysfs',`
allow $1 sysfs_types:lnk_file relabel_lnk_file_perms;
')
########################################
## <summary>
## Set the attributes of sysfs files, directories and symlinks.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`dev_setattr_all_sysfs',`
gen_require(`
attribute sysfs_types;
')
allow $1 sysfs_types:dir { search_dir_perms setattr };
allow $1 sysfs_types:file setattr;
allow $1 sysfs_types:lnk_file { read_lnk_file_perms setattr };
')
########################################
## <summary>
## Read and write the TPM device.

1
policy/modules/system/systemd.te
View File

@ -1087,6 +1087,7 @@ dev_manage_all_dev_nodes(systemd_tmpfiles_t)
dev_read_urand(systemd_tmpfiles_t)
dev_relabel_all_sysfs(systemd_tmpfiles_t)
dev_read_urand(systemd_tmpfiles_t)
dev_setattr_all_sysfs(systemd_tmpfiles_t)
dev_manage_all_dev_nodes(systemd_tmpfiles_t)
files_create_lock_dirs(systemd_tmpfiles_t)