1 |
commit: d372650e27df2987b357dea9a06b20972910452a |
2 |
Author: bauen1 <j2468h <AT> gmail <DOT> com> |
3 |
AuthorDate: Sat Feb 8 15:16:14 2020 +0000 |
4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
5 |
CommitDate: Sat Feb 15 07:32:05 2020 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=d372650e |
7 |
|
8 |
init: split init_create_pid_files interface |
9 |
|
10 |
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> |
11 |
|
12 |
policy/modules/system/init.if | 24 +++++++++++++++++++++--- |
13 |
policy/modules/system/systemd.te | 3 ++- |
14 |
2 files changed, 23 insertions(+), 4 deletions(-) |
15 |
|
16 |
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if |
17 |
index 03538310..b1b6ca2d 100644 |
18 |
--- a/policy/modules/system/init.if |
19 |
+++ b/policy/modules/system/init.if |
20 |
@@ -1400,7 +1400,7 @@ interface(`init_manage_pid_symlinks', ` |
21 |
|
22 |
###################################### |
23 |
## <summary> |
24 |
-## Create and write files in the /run/systemd directory. |
25 |
+## Create files in the /run/systemd directory. |
26 |
## </summary> |
27 |
## <param name="domain"> |
28 |
## <summary> |
29 |
@@ -1408,12 +1408,30 @@ interface(`init_manage_pid_symlinks', ` |
30 |
## </summary> |
31 |
## </param> |
32 |
# |
33 |
-interface(`init_create_write_pid_files', ` |
34 |
+interface(`init_create_pid_files', ` |
35 |
gen_require(` |
36 |
type init_runtime_t; |
37 |
') |
38 |
|
39 |
- allow $1 init_runtime_t:file { create_file_perms write }; |
40 |
+ allow $1 init_runtime_t:file create_file_perms; |
41 |
+') |
42 |
+ |
43 |
+###################################### |
44 |
+## <summary> |
45 |
+## Write files in the /run/systemd directory. |
46 |
+## </summary> |
47 |
+## <param name="domain"> |
48 |
+## <summary> |
49 |
+## Domain allowed access. |
50 |
+## </summary> |
51 |
+## </param> |
52 |
+# |
53 |
+interface(`init_write_pid_files', ` |
54 |
+ gen_require(` |
55 |
+ type init_runtime_t; |
56 |
+ ') |
57 |
+ |
58 |
+ allow $1 init_runtime_t:file write_file_perms; |
59 |
') |
60 |
|
61 |
###################################### |
62 |
|
63 |
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te |
64 |
index f0412af3..3edbc98e 100644 |
65 |
--- a/policy/modules/system/systemd.te |
66 |
+++ b/policy/modules/system/systemd.te |
67 |
@@ -283,10 +283,11 @@ files_search_pids(systemd_fstab_generator_t) |
68 |
|
69 |
fstools_exec(systemd_fstab_generator_t) |
70 |
|
71 |
-init_create_write_pid_files(systemd_fstab_generator_t) |
72 |
+init_create_pid_files(systemd_fstab_generator_t) |
73 |
init_manage_pid_dirs(systemd_fstab_generator_t) |
74 |
init_manage_pid_symlinks(systemd_fstab_generator_t) |
75 |
init_search_pids(systemd_fstab_generator_t) |
76 |
+init_write_pid_files(systemd_fstab_generator_t) |
77 |
|
78 |
kernel_read_kernel_sysctls(systemd_fstab_generator_t) |