diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if index 41f196199..048b9d653 100644 --- a/policy/modules/kernel/filesystem.if +++ b/policy/modules/kernel/filesystem.if @@ -2340,6 +2340,25 @@ interface(`fs_rw_hugetlbfs_files',` rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t) ') +######################################## +## +## Read, map and write hugetlbfs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_mmap_rw_hugetlbfs_files',` + gen_require(` + type hugetlbfs_t; + ') + + fs_rw_hugetlbfs_files($1) + allow $1 hugetlbfs_t:file map; +') + ######################################## ## ## Allow the type to associate to hugetlbfs filesystems. diff --git a/policy/modules/services/postgresql.te b/policy/modules/services/postgresql.te index f118d9d0c..3bdffe4f5 100644 --- a/policy/modules/services/postgresql.te +++ b/policy/modules/services/postgresql.te @@ -290,6 +290,7 @@ files_lock_filetrans(postgresql_t, postgresql_lock_t, file) manage_files_pattern(postgresql_t, postgresql_log_t, postgresql_log_t) logging_log_filetrans(postgresql_t, postgresql_log_t, { file dir }) +allow postgresql_t postgresql_tmp_t:file map; manage_dirs_pattern(postgresql_t, postgresql_tmp_t, postgresql_tmp_t) manage_files_pattern(postgresql_t, postgresql_tmp_t, postgresql_tmp_t) manage_lnk_files_pattern(postgresql_t, postgresql_tmp_t, postgresql_tmp_t) @@ -330,7 +331,7 @@ dev_read_urand(postgresql_t) fs_getattr_all_fs(postgresql_t) fs_search_auto_mountpoints(postgresql_t) -fs_rw_hugetlbfs_files(postgresql_t) +fs_mmap_rw_hugetlbfs_files(postgresql_t) selinux_get_enforce_mode(postgresql_t) selinux_validate_context(postgresql_t)