101 lines
3.2 KiB
Diff
101 lines
3.2 KiB
Diff
From 033c1ffb7c25c218f35ac5053d7f3a482c7df6af Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Thu, 14 Jul 2022 10:30:12 +0200
|
|
Subject: [PATCH] Allow some domains use sd_notify()
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/033c1ffb7c25c218f35ac5053d7f3a482c7df6af
|
|
Conflict: NA
|
|
|
|
sd_notify() and a few similar systemd library functions may be called by
|
|
a service to notify the service manager about state changes. It can be
|
|
used to send arbitrary information. Most importantly, it can be used for
|
|
start-up completion notification.
|
|
|
|
With this commit, all types in the daemon and login_userdomain
|
|
attributes and unconfined_service_t can connect to init (PID 1) and
|
|
init can write back to the fifo_file created by the domain.
|
|
|
|
Resolves: rhbz#1903305
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/system/init.if | 21 +++++++++++++++++++++
|
|
policy/modules/system/init.te | 2 ++
|
|
policy/modules/system/unconfined.te | 2 ++
|
|
policy/modules/system/userdomain.te | 2 ++
|
|
4 files changed, 27 insertions(+)
|
|
|
|
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
|
|
index 4b3bb59..c07649b 100644
|
|
--- a/policy/modules/system/init.if
|
|
+++ b/policy/modules/system/init.if
|
|
@@ -3000,6 +3000,27 @@ interface(`init_rw_tcp_sockets',`
|
|
allow $1 init_t:tcp_socket { read write getattr };
|
|
')
|
|
|
|
+#######################################
|
|
+## <summary>
|
|
+## Use sd_notify
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`init_use_notify',`
|
|
+ gen_require(`
|
|
+ type init_t, init_var_run_t;
|
|
+ ')
|
|
+
|
|
+ files_search_pids($1)
|
|
+ stream_connect_pattern($1, init_var_run_t, init_var_run_t, init_t)
|
|
+ allow $1 init_var_run_t:sock_file read_sock_file_perms;
|
|
+ allow init_t $1:fifo_file write_fifo_file_perms;
|
|
+')
|
|
+
|
|
########################################
|
|
## <summary>
|
|
## Get the system status information from init
|
|
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
|
|
index 073ce2c..e4bc96f 100644
|
|
--- a/policy/modules/system/init.te
|
|
+++ b/policy/modules/system/init.te
|
|
@@ -1335,6 +1335,8 @@ ifdef(`distro_suse',`
|
|
|
|
domain_dontaudit_use_interactive_fds(daemon)
|
|
|
|
+init_use_notify(daemon)
|
|
+
|
|
userdom_dontaudit_list_admin_dir(daemon)
|
|
userdom_dontaudit_search_user_tmp(daemon)
|
|
|
|
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
|
|
index ed03aad..4da1290 100644
|
|
--- a/policy/modules/system/unconfined.te
|
|
+++ b/policy/modules/system/unconfined.te
|
|
@@ -20,6 +20,8 @@ role unconfined_r types unconfined_service_t;
|
|
corecmd_bin_entry_type(unconfined_service_t)
|
|
corecmd_shell_entry_type(unconfined_service_t)
|
|
|
|
+init_use_notify(unconfined_service_t)
|
|
+
|
|
optional_policy(`
|
|
rpm_transition_script(unconfined_service_t, system_r)
|
|
')
|
|
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
|
|
index 3ac8c12..0980247 100644
|
|
--- a/policy/modules/system/userdomain.te
|
|
+++ b/policy/modules/system/userdomain.te
|
|
@@ -400,6 +400,8 @@ files_watch_generic_tmp_dirs(login_userdomain)
|
|
fs_create_cgroup_files(login_userdomain)
|
|
fs_watch_cgroup_files(login_userdomain)
|
|
|
|
+init_use_notify(login_userdomain)
|
|
+
|
|
libs_watch_lib_dirs(login_userdomain)
|
|
|
|
miscfiles_watch_fonts_dirs(login_userdomain)
|
|
--
|
|
1.8.3.1
|
|
|