diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index d1e42acc3..e188a212b 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -2913,7 +2913,7 @@ interface(`files_delete_boot_flag',` ## ## ## -## Domain allowed access. +## Domain to not audit. ## ## # @@ -2925,6 +2925,25 @@ interface(`files_dontaudit_setattr_etc_runtime_files',` dontaudit $1 etc_runtime_t:file setattr; ') +######################################## +## +## Do not audit attempts to write +## etc runtime files. +## +## +## +## Domain to not audit. +## +## +# +interface(`files_dontaudit_write_etc_runtime_files',` + gen_require(` + type etc_runtime_t; + ') + + dontaudit $1 etc_runtime_t:file write; +') + ######################################## ## ## Read files in /etc that are dynamically