nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

systemd: add policy for systemd-sysctl

Browse Source 
Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2021-03-12 20:32:16 -05:00
parent 403c4c3470
commit dbecb3546d
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/system/systemd.fc
View File

@ -39,6 +39,7 @@
/usr/lib/systemd/systemd-resolved -- gen_context(system_u:object_r:systemd_resolved_exec_t,s0)
/usr/lib/systemd/systemd-rfkill -- gen_context(system_u:object_r:systemd_rfkill_exec_t,s0)
/usr/lib/systemd/systemd-socket-proxyd -- gen_context(system_u:object_r:systemd_socket_proxyd_exec_t,s0)
/usr/lib/systemd/systemd-sysctl -- gen_context(system_u:object_r:systemd_sysctl_exec_t,s0)
/usr/lib/systemd/systemd-update-done -- gen_context(system_u:object_r:systemd_update_done_exec_t,s0)
/usr/lib/systemd/systemd-user-runtime-dir -- gen_context(system_u:object_r:systemd_user_runtime_dir_exec_t,s0)
/usr/lib/systemd/systemd-user-sessions -- gen_context(system_u:object_r:systemd_sessions_exec_t,s0)

19
policy/modules/system/systemd.te
View File

@ -260,6 +260,10 @@ corenet_port(systemd_socket_proxyd_port_t)
type systemd_socket_proxyd_unit_file_t;
init_unit_file(systemd_socket_proxyd_unit_file_t)
type systemd_sysctl_t;
type systemd_sysctl_exec_t;
init_daemon_domain(systemd_sysctl_t, systemd_sysctl_exec_t)
type systemd_sysusers_t;
type systemd_sysusers_exec_t;
init_system_domain(systemd_sysusers_t, systemd_sysusers_exec_t)
@ -1269,6 +1273,21 @@ seutil_read_file_contexts(systemd_sessions_t)
systemd_log_parse_environment(systemd_sessions_t)
########################################
#
# sysctl local policy
#
dontaudit systemd_sysctl_t self:capability sys_ptrace;
kernel_read_kernel_sysctls(systemd_sysctl_t)
kernel_request_load_module(systemd_sysctl_t)
kernel_rw_all_sysctls(systemd_sysctl_t)
kernel_dontaudit_getattr_proc(systemd_sysctl_t)
files_read_etc_files(systemd_sysctl_t)
systemd_log_parse_environment(systemd_sysctl_t)
#########################################
#