From 489674d8ad8253a18cf88425f2fe3dbf265d03a1 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 17 Jan 2022 12:44:10 +0100 Subject: [PATCH] Allow sysadm_t start and stop transient services Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/489674d8ad8253a18cf88425f2fe3dbf265d03a1 Conflict: NA Addresses the following AVC denial: type=USER_AVC msg=audit(01/07/2022 03:27:48.362:345) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=unset uid=root gid=root cmdline="" scontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:init_t:s0 tclass=system permissive=1 exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' # Date: Mon Jan 17 12:44:10 2022 +0100 Resolves: rhbz#2031065 Signed-off-by: lujie54 --- policy/modules/roles/sysadm.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index fae8028..d9e11b6 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -81,6 +81,8 @@ init_exec(sysadm_t) init_exec_script_files(sysadm_t) init_dbus_chat(sysadm_t) init_script_role_transition(sysadm_r) +init_start(sysadm_t) +init_stop(sysadm_t) init_status(sysadm_t) init_reboot(sysadm_t) init_halt(sysadm_t) -- 1.8.3.1