64 lines
1.8 KiB
Diff
64 lines
1.8 KiB
Diff
From a27476b303259a43324be8533ddba68e7a6dd37e Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Wed, 2 Feb 2022 16:21:01 +0100
|
|
Subject: [PATCH] Allow init read stratis data symlinks
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/a27476b303259a43324be8533ddba68e7a6dd37e
|
|
Conflict: NA
|
|
|
|
Addresses the following AVC denial:
|
|
|
|
type=AVC msg=audit(02/02/22 09:39:31.790:2813) : avc: denied { read } for pid=1 comm=systemd name=fs1 dev="devtmpfs" ino=363096 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:stratisd_data_t:s0 tclass=lnk_file permissive=1
|
|
|
|
Resolves: rhbz#2048514
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/contrib/stratisd.if | 18 ++++++++++++++++++
|
|
policy/modules/system/init.te | 4 ++++
|
|
2 files changed, 22 insertions(+)
|
|
|
|
diff --git a/policy/modules/contrib/stratisd.if b/policy/modules/contrib/stratisd.if
|
|
index de2427e..32e7e66 100644
|
|
--- a/policy/modules/contrib/stratisd.if
|
|
+++ b/policy/modules/contrib/stratisd.if
|
|
@@ -115,3 +115,21 @@ interface(`stratisd_admin',`
|
|
systemd_read_fifo_file_passwd_run($1)
|
|
')
|
|
')
|
|
+
|
|
+########################################
|
|
+## <summary>
|
|
+## Read stratisd data symlinks
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`stratisd_data_read_lnk_files',`
|
|
+ gen_require(`
|
|
+ type stratisd_data_t;
|
|
+ ')
|
|
+
|
|
+ allow $1 stratisd_data_t:lnk_file read_lnk_file_perms;
|
|
+')
|
|
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
|
|
index 09a6925..033f189 100644
|
|
--- a/policy/modules/system/init.te
|
|
+++ b/policy/modules/system/init.te
|
|
@@ -839,6 +839,10 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
+ stratisd_data_read_lnk_files(init_t)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
systemd_filetrans_named_content(init_t)
|
|
systemd_write_inhibit_pipes(init_t)
|
|
')
|
|
--
|
|
1.8.3.1
|
|
|