diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if index e2e3a041d..1ae99ea50 100644 --- a/policy/modules/kernel/filesystem.if +++ b/policy/modules/kernel/filesystem.if @@ -785,6 +785,24 @@ interface(`fs_relabel_cgroup_dirs',` relabel_dirs_pattern($1, cgroup_t, cgroup_t) ') +######################################## +## +## Relabel cgroup symbolic links. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_relabel_cgroup_lnk_files',` + gen_require(` + type cgroup_t; + ') + + relabel_lnk_files_pattern($1, cgroup_t, cgroup_t) +') + ######################################## ## ## Get attributes of cgroup files. diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 8a91df259..ff760a3e4 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -355,6 +355,7 @@ ifdef(`init_systemd',` fs_manage_hugetlbfs_dirs(init_t) fs_getattr_tmpfs(init_t) fs_read_tmpfs_files(init_t) + fs_relabel_cgroup_lnk_files(init_t) fs_relabel_pstore_dirs(init_t) fs_dontaudit_getattr_xattr_fs(init_t) fs_create_cgroup_links(init_t)