[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Jason Zaman]

commit:     ec7d886c63f83a6e50cbe816f255a653c2d8b17c
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Mon Oct 30 07:32:33 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Oct 30 08:39:42 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=ec7d886c

salt: master and minion need to map tmpfs files

 policy/modules/contrib/salt.te | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/policy/modules/contrib/salt.te b/policy/modules/contrib/salt.te
index 9a8a4ad8..2eb7b7db 100644
--- a/policy/modules/contrib/salt.te
+++ b/policy/modules/contrib/salt.te
@@ -72,6 +72,9 @@ files_type(salt_minion_pki_t)
 type salt_minion_tmp_t;
 files_tmp_file(salt_minion_tmp_t)
 
+type salt_minion_tmpfs_t;
+files_tmpfs_file(salt_minion_tmpfs_t)
+
 type salt_minion_var_run_t;
 init_daemon_pid_file(salt_minion_var_run_t, file, "salt-minion.pid")
 files_pid_file(salt_minion_var_run_t)
@@ -144,7 +147,7 @@ files_tmp_filetrans(salt_master_t, salt_master_tmp_t, { file dir })
 can_exec(salt_master_t, salt_master_tmp_t)
 
 # salt_master_tmpfs_t
-allow salt_master_t salt_master_tmpfs_t:file manage_file_perms;
+allow salt_master_t salt_master_tmpfs_t:file { manage_file_perms map };
 fs_tmpfs_filetrans(salt_master_t, salt_master_tmpfs_t, file)
 
 # salt_master_var_run_t
@@ -262,6 +265,10 @@ files_tmp_filetrans(salt_minion_t, salt_minion_tmp_t, { file dir })
 # libffi, screw you
 can_exec(salt_minion_t, salt_minion_tmp_t)
 
+# salt_minion_tmpfs_t
+allow salt_minion_t salt_minion_tmpfs_t:file { manage_file_perms map };
+fs_tmpfs_filetrans(salt_minion_t, salt_minion_tmpfs_t, file)
+
 # salt_minion_var_run_t
 allow salt_minion_t salt_minion_var_run_t:file manage_file_perms;
 allow salt_minion_t salt_minion_var_run_t:sock_file manage_sock_file_perms;