From 722bd1fc180b12193c2d551c82eda101f26c098f Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 8 Aug 2022 17:35:10 +0200 Subject: [PATCH] Do not allow login_userdomain use sd_notify() Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/722bd1fc180b12193c2d551c82eda101f26c098f Conflict: NA This commit partially reverts the ea76c5e8b586 ("Allow some domains use sd_notify()") commit. While any systemd service should be allowed to use sd_notify, which includes unconfined_service_t, login userdomains should only talk to user service manager which runs in the respective userdomain. Signed-off-by: lujie54 --- policy/modules/system/userdomain.te | 2 -- 1 file changed, 2 deletions(-) diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te index 0980247..3ac8c12 100644 --- a/policy/modules/system/userdomain.te +++ b/policy/modules/system/userdomain.te @@ -400,8 +400,6 @@ files_watch_generic_tmp_dirs(login_userdomain) fs_create_cgroup_files(login_userdomain) fs_watch_cgroup_files(login_userdomain) -init_use_notify(login_userdomain) - libs_watch_lib_dirs(login_userdomain) miscfiles_watch_fonts_dirs(login_userdomain) -- 1.8.3.1