35 lines
1.4 KiB
Diff
35 lines
1.4 KiB
Diff
From 489674d8ad8253a18cf88425f2fe3dbf265d03a1 Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Mon, 17 Jan 2022 12:44:10 +0100
|
|
Subject: [PATCH] Allow sysadm_t start and stop transient services
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/489674d8ad8253a18cf88425f2fe3dbf265d03a1
|
|
Conflict: NA
|
|
|
|
Addresses the following AVC denial:
|
|
|
|
type=USER_AVC msg=audit(01/07/2022 03:27:48.362:345) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=unset uid=root gid=root cmdline="" scontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:init_t:s0 tclass=system permissive=1 exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' # Date: Mon Jan 17 12:44:10 2022 +0100
|
|
|
|
Resolves: rhbz#2031065
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/roles/sysadm.te | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
|
|
index fae8028..d9e11b6 100644
|
|
--- a/policy/modules/roles/sysadm.te
|
|
+++ b/policy/modules/roles/sysadm.te
|
|
@@ -81,6 +81,8 @@ init_exec(sysadm_t)
|
|
init_exec_script_files(sysadm_t)
|
|
init_dbus_chat(sysadm_t)
|
|
init_script_role_transition(sysadm_r)
|
|
+init_start(sysadm_t)
|
|
+init_stop(sysadm_t)
|
|
init_status(sysadm_t)
|
|
init_reboot(sysadm_t)
|
|
init_halt(sysadm_t)
|
|
--
|
|
1.8.3.1
|
|
|