From 033c1ffb7c25c218f35ac5053d7f3a482c7df6af Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Thu, 14 Jul 2022 10:30:12 +0200 Subject: [PATCH] Allow some domains use sd_notify() Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/033c1ffb7c25c218f35ac5053d7f3a482c7df6af Conflict: NA sd_notify() and a few similar systemd library functions may be called by a service to notify the service manager about state changes. It can be used to send arbitrary information. Most importantly, it can be used for start-up completion notification. With this commit, all types in the daemon and login_userdomain attributes and unconfined_service_t can connect to init (PID 1) and init can write back to the fifo_file created by the domain. Resolves: rhbz#1903305 Signed-off-by: lujie54 --- policy/modules/system/init.if | 21 +++++++++++++++++++++ policy/modules/system/init.te | 2 ++ policy/modules/system/unconfined.te | 2 ++ policy/modules/system/userdomain.te | 2 ++ 4 files changed, 27 insertions(+) diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if index 4b3bb59..c07649b 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -3000,6 +3000,27 @@ interface(`init_rw_tcp_sockets',` allow $1 init_t:tcp_socket { read write getattr }; ') +####################################### +## +## Use sd_notify +## +## +## +## Domain allowed access. +## +## +# +interface(`init_use_notify',` + gen_require(` + type init_t, init_var_run_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, init_var_run_t, init_var_run_t, init_t) + allow $1 init_var_run_t:sock_file read_sock_file_perms; + allow init_t $1:fifo_file write_fifo_file_perms; +') + ######################################## ## ## Get the system status information from init diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 073ce2c..e4bc96f 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -1335,6 +1335,8 @@ ifdef(`distro_suse',` domain_dontaudit_use_interactive_fds(daemon) +init_use_notify(daemon) + userdom_dontaudit_list_admin_dir(daemon) userdom_dontaudit_search_user_tmp(daemon) diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te index ed03aad..4da1290 100644 --- a/policy/modules/system/unconfined.te +++ b/policy/modules/system/unconfined.te @@ -20,6 +20,8 @@ role unconfined_r types unconfined_service_t; corecmd_bin_entry_type(unconfined_service_t) corecmd_shell_entry_type(unconfined_service_t) +init_use_notify(unconfined_service_t) + optional_policy(` rpm_transition_script(unconfined_service_t, system_r) ') diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te index 3ac8c12..0980247 100644 --- a/policy/modules/system/userdomain.te +++ b/policy/modules/system/userdomain.te @@ -400,6 +400,8 @@ files_watch_generic_tmp_dirs(login_userdomain) fs_create_cgroup_files(login_userdomain) fs_watch_cgroup_files(login_userdomain) +init_use_notify(login_userdomain) + libs_watch_lib_dirs(login_userdomain) miscfiles_watch_fonts_dirs(login_userdomain) -- 1.8.3.1