From 8304d9b80b3cb22e429d2113cf81dca07d306dd7 Mon Sep 17 00:00:00 2001 From: Quintin Hill Date: Fri, 2 Sep 2022 16:44:37 +0100 Subject: [PATCH] Allow systemd-gpt-auto-generator to check for empty dirs systemd-gpt-auto-generator wants to check that certain subdirectories of / are empty before generating mount units for them this is not permitted by policy. Addresses: systemd-gpt-auto-generator[388]: Cannot check if "/home" is empty: Permission denied kernel: audit: type=1400 audit(1662118200.418:80): avc: denied { read } for pid=388 comm="systemd-gpt-aut" name="home" dev="sda2" ino=3180 scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir permissive=0 audit[388]: AVC avc: denied { read } for pid=388 comm="systemd-gpt-aut" name="var" dev="sda2" ino=362569 scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=0 systemd-gpt-auto-generator[388]: Cannot check if "/var" is empty: Permission denied Resolves: rhbz#2123765 Signed-off-by: lujie42 --- policy/modules/system/systemd.te | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index a9308b8cc..028820491 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -1112,6 +1112,11 @@ dev_read_sysfs(systemd_gpt_generator_t) dev_write_kmsg(systemd_gpt_generator_t) dev_read_rand(systemd_gpt_generator_t) +files_list_boot(systemd_gpt_generator_t) +files_list_home(systemd_gpt_generator_t) +files_list_tmp(systemd_gpt_generator_t) +files_list_usr(systemd_gpt_generator_t) +files_list_var(systemd_gpt_generator_t) fstools_exec(systemd_gpt_generator_t) -- 2.27.0