diff --git a/policy/modules/kernel/corecommands.te b/policy/modules/kernel/corecommands.te index 447cf17eb..dabd3b066 100644 --- a/policy/modules/kernel/corecommands.te +++ b/policy/modules/kernel/corecommands.te @@ -14,7 +14,7 @@ attribute exec_type; # bin_t is the type of files in the system bin/sbin directories. # type bin_t alias { ls_exec_t sbin_t }; -typealias bin_t alias systemd_detect_virt_t; +typealias bin_t alias { systemd_detect_virt_t systemd_run_exec_t }; corecmd_executable_file(bin_t) dev_associate(bin_t) #For /dev/MAKEDEV diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc index 7b38de434..0ccb9ccaa 100644 --- a/policy/modules/system/systemd.fc +++ b/policy/modules/system/systemd.fc @@ -10,7 +10,6 @@ /usr/bin/systemd-coredump -- gen_context(system_u:object_r:systemd_coredump_exec_t,s0) /usr/bin/systemd-hwdb -- gen_context(system_u:object_r:systemd_hw_exec_t,s0) /usr/bin/systemd-nspawn -- gen_context(system_u:object_r:systemd_nspawn_exec_t,s0) -/usr/bin/systemd-run -- gen_context(system_u:object_r:systemd_run_exec_t,s0) /usr/bin/systemd-stdio-bridge -- gen_context(system_u:object_r:systemd_stdio_bridge_exec_t,s0) /usr/bin/systemd-sysusers -- gen_context(system_u:object_r:systemd_sysusers_exec_t,s0) /usr/bin/systemd-tmpfiles -- gen_context(system_u:object_r:systemd_tmpfiles_exec_t,s0) diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if index 1da951f0e..62545021e 100644 --- a/policy/modules/system/systemd.if +++ b/policy/modules/system/systemd.if @@ -29,7 +29,7 @@ template(`systemd_role_template',` gen_require(` attribute systemd_user_session_type, systemd_log_parse_env_type; attribute systemd_user_activated_sock_file_type, systemd_user_unix_stream_activated_socket_type; - type systemd_run_exec_t, systemd_analyze_exec_t; + type systemd_analyze_exec_t; type systemd_conf_home_t, systemd_data_home_t; type systemd_user_runtime_t, systemd_user_runtime_notify_t; type systemd_user_unit_t; @@ -157,7 +157,7 @@ template(`systemd_role_template',` allow $3 systemd_user_unit_t:service { reload start status stop }; allow $3 systemd_conf_home_t:service { reload start status stop }; - can_exec($3, { systemd_run_exec_t systemd_analyze_exec_t }) + can_exec($3, systemd_analyze_exec_t) init_dbus_chat($3) init_search_var_lib_dirs($3) diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index fb69ffa41..584e8aa08 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -229,10 +229,6 @@ init_system_domain(systemd_resolved_t, systemd_resolved_exec_t) type systemd_resolved_runtime_t alias systemd_resolved_var_run_t; files_runtime_file(systemd_resolved_runtime_t) -type systemd_run_t; -type systemd_run_exec_t; -init_daemon_domain(systemd_run_t, systemd_run_exec_t) - type systemd_stdio_bridge_t; type systemd_stdio_bridge_exec_t; init_system_domain(systemd_stdio_bridge_t, systemd_stdio_bridge_exec_t)