nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

init, systemd: allow init to create userdb runtime symlinks

Browse Source 
At boot, systemd-init will create symlinks in /run/systemd/userdb. This
fixes these AVCs:

avc:  denied  { create } for  pid=1 comm="systemd" name="io.systemd.NameServiceSwitch" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=lnk_file permissive=0
avc:  denied  { create } for  pid=1 comm="systemd" name="io.systemd.DropIn" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=lnk_file permissive=0

Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2023-03-06 10:25:29 -05:00
parent 079de3d496
commit 9af88f2bf7
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/system/init.te
View File

@ -534,6 +534,7 @@ ifdef(`init_systemd',`
systemd_rw_networkd_netlink_route_sockets(init_t)
systemd_manage_userdb_runtime_sock_files(init_t)
systemd_manage_userdb_runtime_dirs(init_t)
systemd_manage_userdb_runtime_symlinks(init_t)
systemd_filetrans_userdb_runtime_dirs(init_t)
systemd_stream_connect_userdb(init_t)

18
policy/modules/system/systemd.if
View File

@ -1402,6 +1402,24 @@ interface(`systemd_read_userdb_runtime_files', `
read_files_pattern($1, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t)
')
########################################
## <summary>
## Manage symbolic links under /run/systemd/userdb.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`systemd_manage_userdb_runtime_symlinks', `
gen_require(`
type systemd_userdbd_runtime_t;
')
manage_lnk_files_pattern($1, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t)
')
########################################
## <summary>
## Manage socket files under /run/systemd/userdb .