diff options
| author |   Kenton Groombridge <me@concord.sh> | 2023-03-06 13:37:02 -0500 |
|---|---|---|
| committer |   Kenton Groombridge <concord@gentoo.org> | 2023-03-31 13:11:32 -0400 |
| commit | 71328f3f02d4765b904f1a2a6c9fe140cb116182 (patch) | |
| tree | 332116d16e909a0580e5c192ac7d3874fbbd4ce7 | |
| parent | logging, systemd: allow relabelfrom,relabelto on systemd journal files by sys... (diff) | |
| download | hardened-refpolicy-71328f3f.tar.gz hardened-refpolicy-71328f3f.tar.bz2 hardened-refpolicy-71328f3f.zip | |
files, systemd: allow systemd-tmpfiles to relabel config file symlinks
Signed-off-by: Kenton Groombridge <me@concord.sh>
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
| -rw-r--r-- | policy/modules/kernel/files.if | 19 | ||||
| -rw-r--r-- | policy/modules/system/systemd.te | 3 |
2 files changed, 21 insertions, 1 deletions
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index a895f373..6fe764a7 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -1713,6 +1713,25 @@ interface(`files_dontaudit_relabel_config_files',` dontaudit $1 configfile:file relabel_file_perms; ') +####################################### +## <summary> +## Relabel configuration symlinks. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## +# +interface(`files_relabel_config_symlinks',` + gen_require(` + attribute configfile; + ') + + relabel_lnk_files_pattern($1, configfile, configfile) +') + ######################################## ## <summary> ## Mount a filesystem on all mount points. diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index 778052cd..59a3fcfc 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -1704,8 +1704,9 @@ files_manage_all_locks(systemd_tmpfiles_t) files_purge_tmp(systemd_tmpfiles_t) files_read_etc_files(systemd_tmpfiles_t) files_read_etc_runtime_files(systemd_tmpfiles_t) -files_relabel_config_files(systemd_tmpfiles_t) files_relabel_config_dirs(systemd_tmpfiles_t) +files_relabel_config_files(systemd_tmpfiles_t) +files_relabel_config_symlinks(systemd_tmpfiles_t) files_relabel_all_locks(systemd_tmpfiles_t) files_relabel_all_runtime_dirs(systemd_tmpfiles_t) files_relabel_all_tmp_dirs(systemd_tmpfiles_t) |