From a27476b303259a43324be8533ddba68e7a6dd37e Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Wed, 2 Feb 2022 16:21:01 +0100 Subject: [PATCH] Allow init read stratis data symlinks Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/a27476b303259a43324be8533ddba68e7a6dd37e Conflict: NA Addresses the following AVC denial: type=AVC msg=audit(02/02/22 09:39:31.790:2813) : avc: denied { read } for pid=1 comm=systemd name=fs1 dev="devtmpfs" ino=363096 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:stratisd_data_t:s0 tclass=lnk_file permissive=1 Resolves: rhbz#2048514 Signed-off-by: lujie54 --- policy/modules/contrib/stratisd.if | 18 ++++++++++++++++++ policy/modules/system/init.te | 4 ++++ 2 files changed, 22 insertions(+) diff --git a/policy/modules/contrib/stratisd.if b/policy/modules/contrib/stratisd.if index de2427e..32e7e66 100644 --- a/policy/modules/contrib/stratisd.if +++ b/policy/modules/contrib/stratisd.if @@ -115,3 +115,21 @@ interface(`stratisd_admin',` systemd_read_fifo_file_passwd_run($1) ') ') + +######################################## +## +## Read stratisd data symlinks +## +## +## +## Domain allowed access. +## +## +# +interface(`stratisd_data_read_lnk_files',` + gen_require(` + type stratisd_data_t; + ') + + allow $1 stratisd_data_t:lnk_file read_lnk_file_perms; +') diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 09a6925..033f189 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -839,6 +839,10 @@ optional_policy(` ') optional_policy(` + stratisd_data_read_lnk_files(init_t) +') + +optional_policy(` systemd_filetrans_named_content(init_t) systemd_write_inhibit_pipes(init_t) ') -- 1.8.3.1