nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

systemd: add systemd-binfmt policy

Browse Source 
This systemd service registers in /proc/sys/fs/binfmt_misc binary formats
for executables.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
This commit is contained in:
Nicolas Iooss 2016-12-27 14:45:21 +01:00
parent 938fc23ce5
commit da59af22f4
No known key found for this signature in database
GPG Key ID: C191415F340DAAA0
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/system/systemd.fc
View File

@ -29,6 +29,7 @@
/usr/lib/systemd/system/[^/]*sleep.* -- gen_context(system_u:object_r:power_unit_t,s0)
/usr/lib/systemd/system/[^/]*suspend.* -- gen_context(system_u:object_r:power_unit_t,s0)
/usr/lib/systemd/system/systemd-backlight.* -- gen_context(system_u:object_r:systemd_backlight_unit_t,s0)
/usr/lib/systemd/system/systemd-binfmt.* -- gen_context(system_u:object_r:systemd_binfmt_unit_t,s0)
/var/lib/systemd/backlight(/.*)? gen_context(system_u:object_r:systemd_backlight_var_lib_t,s0)
/var/lib/systemd/linger(/.*)? gen_context(system_u:object_r:systemd_logind_var_lib_t,s0)

15
policy/modules/system/systemd.te
View File

@ -36,6 +36,9 @@ type systemd_binfmt_t;
type systemd_binfmt_exec_t;
init_system_domain(systemd_binfmt_t, systemd_binfmt_exec_t)
type systemd_binfmt_unit_t;
init_unit_file(systemd_binfmt_unit_t)
type systemd_cgroups_t;
type systemd_cgroups_exec_t;
domain_type(systemd_cgroups_t)
@ -162,6 +165,18 @@ files_read_etc_files(systemd_backlight_t)
udev_read_pid_files(systemd_backlight_t)
#######################################
#
# Binfmt local policy
#
systemd_log_parse_environment(systemd_binfmt_t)
# Allow to read /etc/binfmt.d/ files
files_read_etc_files(systemd_binfmt_t)
fs_register_binary_executable_type(systemd_binfmt_t)
######################################
#
# Cgroups local policy