nnd
/
selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

filesystem/systemd: memory.pressure fixes. 

Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
This commit is contained in:
Chris PeBenito 2024-04-29 16:36:38 -04:00
parent d049eb2173
commit 7d998958dc
3 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
policy/modules/kernel/filesystem.fc
View File

@ -14,14 +14,15 @@
/sys/fs/bpf(/.*)? <<none>>
/sys/fs/cgroup -d gen_context(system_u:object_r:cgroup_t,s0)
/sys/fs/cgroup/.* <<none>>
/sys/fs/cgroup/[^/]+ -l gen_context(system_u:object_r:cgroup_t,s0)
/sys/fs/cgroup/.* gen_context(system_u:object_r:cgroup_t,s0)
/sys/fs/pstore -d gen_context(system_u:object_r:pstore_t,s0)
/sys/fs/pstore/.* <<none>>
/sys/kernel/tracing(/.*)? <<none>>
/sys/fs/cgroup/.*/memory\.pressure -- gen_context(system_u:object_r:memory_pressure_t,s0)
ifdef(`distro_debian',`
/run/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
/run/shm/.* <<none>>

1
policy/modules/kernel/filesystem.te
View File

@ -95,6 +95,7 @@ files_mountpoint(cgroup_t)
dev_associate_sysfs(cgroup_t)
genfscon cgroup / gen_context(system_u:object_r:cgroup_t,s0)
genfscon cgroup2 / gen_context(system_u:object_r:cgroup_t,s0)
allow cgroup_types cgroup_t:filesystem associate;
# When running under systemd, the cgroup file memory.pressure will have this
# separate label, to allow unprivileged process to access it without accessing
# the rest of the cgroup tree.

2
policy/modules/system/systemd.te
View File

@ -658,6 +658,7 @@ files_search_tmp(systemd_homed_t)
fs_get_xattr_fs_quotas(systemd_homed_t)
fs_getattr_all_fs(systemd_homed_t)
fs_watch_memory_pressure(systemd_homed_t)
kernel_read_kernel_sysctls(systemd_homed_t)
kernel_read_system_state(systemd_homed_t)
@ -2066,6 +2067,7 @@ files_read_usr_files(systemd_userdbd_t)
fs_getattr_all_fs(systemd_userdbd_t)
fs_search_cgroup_dirs(systemd_userdbd_t)
fs_read_efivarfs_files(systemd_userdbd_t)
fs_watch_memory_pressure(systemd_userdbd_t)
kernel_read_system_state(systemd_userdbd_t)