dd84b117e2
avc: denied { watch } for pid=12488 comm="gmain" path="/etc" dev="zfs" ino=1436 scontext=system_u:system_r:devicekit_disk_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0
avc: denied { watch } for pid=6452 comm="gmain" path="/run/ConsoleKit" dev="tmpfs" ino=17611 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:consolekit_runtime_t:s0 tclass=dir permissive=0
avc: denied { watch } for pid=6452 comm="gmain" path="/usr/share/polkit-1/actions" dev="zfs" ino=235638 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0
avc: denied { watch } for pid=6452 comm="gmain" path="/etc/polkit-1/rules.d" dev="zfs" ino=268215 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0
Signed-off-by: Jason Zaman <jason@perfinion.com>
142 lines
2.9 KiB
Plaintext
142 lines
2.9 KiB
Plaintext
## <summary>Framework for facilitating multiple user sessions on desktops.</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute a domain transition to run consolekit.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`consolekit_domtrans',`
|
|
gen_require(`
|
|
type consolekit_t, consolekit_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, consolekit_exec_t, consolekit_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send and receive messages from
|
|
## consolekit over dbus.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`consolekit_dbus_chat',`
|
|
gen_require(`
|
|
type consolekit_t;
|
|
class dbus send_msg;
|
|
')
|
|
|
|
allow $1 consolekit_t:dbus send_msg;
|
|
allow consolekit_t $1:dbus send_msg;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Use consolekit inhibit locks.
|
|
##
|
|
## The program gets passed an FD to a fifo_file to hold.
|
|
## When the application is done with the lock, it closes the FD.
|
|
## Implements this API: https://www.freedesktop.org/wiki/Software/systemd/inhibit/
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`consolekit_use_inhibit_lock',`
|
|
gen_require(`
|
|
type consolekit_t, consolekit_runtime_t;
|
|
')
|
|
|
|
allow $1 consolekit_t:fd use;
|
|
allow $1 consolekit_runtime_t:fifo_file rw_inherited_fifo_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read consolekit log files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`consolekit_read_log',`
|
|
gen_require(`
|
|
type consolekit_log_t;
|
|
')
|
|
|
|
read_files_pattern($1, consolekit_log_t, consolekit_log_t)
|
|
logging_search_logs($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create, read, write, and delete
|
|
## consolekit log files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`consolekit_manage_log',`
|
|
gen_require(`
|
|
type consolekit_log_t;
|
|
')
|
|
|
|
manage_files_pattern($1, consolekit_log_t, consolekit_log_t)
|
|
files_search_pids($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read consolekit PID files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`consolekit_read_pid_files',`
|
|
gen_require(`
|
|
type consolekit_runtime_t;
|
|
')
|
|
|
|
files_search_pids($1)
|
|
allow $1 consolekit_runtime_t:dir list_dir_perms;
|
|
read_files_pattern($1, consolekit_runtime_t, consolekit_runtime_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Watch consolekit runtime dir.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`consolekit_watch_runtime_dir',`
|
|
gen_require(`
|
|
type consolekit_runtime_t;
|
|
')
|
|
|
|
allow $1 consolekit_runtime_t:dir watch;
|
|
')
|