63 lines
2.0 KiB
Diff
63 lines
2.0 KiB
Diff
|
From 3ee8fe2590c37f451ad2ff2271b13daa128335d8 Mon Sep 17 00:00:00 2001
|
||
|
|
From: guoxiaoqi <guoxiaoqi2@huawei.com>
|
||
|
|
Date: Sat, 18 Jan 2020 12:03:36 +0800
|
||
|
|
Subject: [PATCH] add allowed avc for systemd
|
||
|
|
|
||
|
|
Signed-off-by: guoxiaoqi <guoxiaoqi2@huawei.com>
|
||
|
|
---
|
||
|
|
policy/modules/kernel/kernel.if | 17 +++++++++++++++++
|
||
|
|
policy/modules/system/init.te | 1 +
|
||
|
|
policy/modules/system/systemd.te | 2 ++
|
||
|
|
3 files changed, 20 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
|
||
|
|
index cb9602c..be3f313 100644
|
||
|
|
--- a/policy/modules/kernel/kernel.if
|
||
|
|
+++ b/policy/modules/kernel/kernel.if
|
||
|
|
@@ -4108,3 +4108,20 @@ interface(`kernel_unlabeled_entry_type',`
|
||
|
|
allow $1 unlabeled_t:file { mmap_exec_file_perms ioctl lock };
|
||
|
|
')
|
||
|
|
|
||
|
|
+########################################
|
||
|
|
+## <summary>
|
||
|
|
+## add for systemd mounton
|
||
|
|
+## </summary>
|
||
|
|
+## <param name="domain">
|
||
|
|
+## <summary>
|
||
|
|
+## The domain for sysctl_kernel_t.
|
||
|
|
+## </summary>
|
||
|
|
+## </param>
|
||
|
|
+##
|
||
|
|
+interface(`kernel_file_mounton','
|
||
|
|
+ gen_require(`
|
||
|
|
+ type sysctl_kernel_t;
|
||
|
|
+ ')
|
||
|
|
+
|
||
|
|
+ allow $1 sysctl_kernel_t:file mounton;
|
||
|
|
+')
|
||
|
|
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
|
||
|
|
index ffe5293..035720b 100644
|
||
|
|
--- a/policy/modules/system/init.te
|
||
|
|
+++ b/policy/modules/system/init.te
|
||
|
|
@@ -224,6 +224,7 @@ kernel_mounton_systemd_ProtectKernelTunables(init_t)
|
||
|
|
kernel_read_core_if(init_t)
|
||
|
|
kernel_mounton_core_if(init_t)
|
||
|
|
kernel_get_sysvipc_info(init_t)
|
||
|
|
+kernel_file_mounton(init_t)
|
||
|
|
|
||
|
|
# There is bug in kernel in 4.16 where lot of domains requesting module_request, for now dontauditing
|
||
|
|
kernel_dontaudit_request_load_module(init_t)
|
||
|
|
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
|
||
|
|
index 22ddccf..d6ce679 100644
|
||
|
|
--- a/policy/modules/system/systemd.te
|
||
|
|
+++ b/policy/modules/system/systemd.te
|
||
|
|
@@ -1140,3 +1140,5 @@ optional_policy(`
|
||
|
|
optional_policy(`
|
||
|
|
gpg_exec(systemd_importd_t)
|
||
|
|
')
|
||
|
|
+allow init_t systemd_logind_inhibit_var_run_t:dir mounton;
|
||
|
|
+allow init_t systemd_logind_sessions_t:dir mounton;
|
||
|
|
--
|
||
|
|
1.8.3.1
|
||
|
|
|