diff options
| author |   Chris PeBenito <pebenito@ieee.org> | 2019-01-20 16:36:36 -0500 |
|---|---|---|
| committer |   Jason Zaman <jason@perfinion.com> | 2019-02-10 12:11:25 +0800 |
| commit | 445d5b61b56c86ba0d836678a42b7a61b083a61c (patch) | |
| tree | cf67c752aa10c3c3f22367d9626750dbbdd978a3 /policy/modules | |
| parent | map systemd private dirs (diff) | |
| download | hardened-refpolicy-445d5b61b56c86ba0d836678a42b7a61b083a61c.tar.gz hardened-refpolicy-445d5b61b56c86ba0d836678a42b7a61b083a61c.tar.bz2 hardened-refpolicy-445d5b61b56c86ba0d836678a42b7a61b083a61c.zip | |
systemd: Move interface implementation.
Signed-off-by: Jason Zaman <jason@perfinion.com>
Diffstat (limited to 'policy/modules')
| -rw-r--r-- | policy/modules/system/systemd.if | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if index c6d40b10..8d2bb8da 100644 --- a/policy/modules/system/systemd.if +++ b/policy/modules/system/systemd.if @@ -391,7 +391,7 @@ interface(`systemd_manage_all_units',` ######################################## ## <summary> -## Allow domain to create/manage systemd_journal_t files +## Allow domain to read systemd_journal_t files ## </summary> ## <param name="domain"> ## <summary> @@ -399,19 +399,18 @@ interface(`systemd_manage_all_units',` ## </summary> ## </param> # -interface(`systemd_manage_journal_files',` +interface(`systemd_read_journal_files',` gen_require(` type systemd_journal_t; ') - manage_dirs_pattern($1, systemd_journal_t, systemd_journal_t) - manage_files_pattern($1, systemd_journal_t, systemd_journal_t) - allow $1 systemd_journal_t:file map; + list_dirs_pattern($1, systemd_journal_t, systemd_journal_t) + mmap_read_files_pattern($1, systemd_journal_t, systemd_journal_t) ') ######################################## ## <summary> -## Allow domain to read systemd_journal_t files +## Allow domain to create/manage systemd_journal_t files ## </summary> ## <param name="domain"> ## <summary> @@ -419,13 +418,14 @@ interface(`systemd_manage_journal_files',` ## </summary> ## </param> # -interface(`systemd_read_journal_files',` +interface(`systemd_manage_journal_files',` gen_require(` type systemd_journal_t; ') - list_dirs_pattern($1, systemd_journal_t, systemd_journal_t) - mmap_read_files_pattern($1, systemd_journal_t, systemd_journal_t) + manage_dirs_pattern($1, systemd_journal_t, systemd_journal_t) + manage_files_pattern($1, systemd_journal_t, systemd_journal_t) + allow $1 systemd_journal_t:file map; ') ######################################## |