Attachment 1773644 Details for Bug 1860924 – Add interface to init policy for reading init_var_run_t lnk_file

[patch] Add interface to init policy for reading init_var_run_t lnk_file

policy-init.patch (text/plain), 1.25 KB, created by Tuomo Soini on 2021-04-20 07:13:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tuomo Soini

Created: 2021-04-20 07:13:54 UTC

Size: 1.25 KB

patch

obsolete

>https://bugzilla.redhat.com/show_bug.cgi?id=1860924
>
>type=AVC msg=audit(1618848666.470:5310087): avc:  denied  { read } for  pid=1537 comm="dbus-daemon" name="direct:62803" dev="tmpfs" ino=155705304 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=lnk_file permissive=0
>
>diff -up selinux-policy-24ad959314c793b7f035584c0769ad2876e95ba7/policy/modules/system/init.if.init selinux-policy-24ad959314c793b7f035584c0769ad2876e95ba7/policy/modules/system/init.if
>--- selinux-policy-24ad959314c793b7f035584c0769ad2876e95ba7/policy/modules/system/init.if.init	2021-03-15 19:36:21.000000000 +0200
>+++ selinux-policy-24ad959314c793b7f035584c0769ad2876e95ba7/policy/modules/system/init.if	2021-04-19 21:57:28.077567984 +0300
>@@ -2319,6 +2319,24 @@ interface(`init_read_utmp',`
> 
> ########################################
> ## <summary>
>+##	Read init var run lnk_file.
>+## </summary>
>+## <param name="domain">
>+##	<summary>
>+##	Domain allowed access.
>+##	</summary>
>+## </param>
>+#
>+interface(`init_read_var_run_lnk_file',`
>+	gen_require(`
>+		type init_var_run_t;
>+	')
>+
>+	allow $1 init_var_run_t:lnk_file read;
>+')
>+
>+########################################
>+## <summary>
> ##	Read utmp.
> ## </summary>
> ## <param name="domain">

Actions: View | Diff

Attachments on bug 1860924: 1773644 | 1773645