diff options
| -rw-r--r-- | policy/modules/kernel/files.if | 19 | ||||
| -rw-r--r-- | policy/modules/system/systemd.te | 3 |
2 files changed, 21 insertions, 1 deletions
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index a895f373..6fe764a7 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -1713,6 +1713,25 @@ interface(`files_dontaudit_relabel_config_files',` dontaudit $1 configfile:file relabel_file_perms; ') +####################################### +## <summary> +## Relabel configuration symlinks. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## +# +interface(`files_relabel_config_symlinks',` + gen_require(` + attribute configfile; + ') + + relabel_lnk_files_pattern($1, configfile, configfile) +') + ######################################## ## <summary> ## Mount a filesystem on all mount points. diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index 778052cd..59a3fcfc 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -1704,8 +1704,9 @@ files_manage_all_locks(systemd_tmpfiles_t) files_purge_tmp(systemd_tmpfiles_t) files_read_etc_files(systemd_tmpfiles_t) files_read_etc_runtime_files(systemd_tmpfiles_t) -files_relabel_config_files(systemd_tmpfiles_t) files_relabel_config_dirs(systemd_tmpfiles_t) +files_relabel_config_files(systemd_tmpfiles_t) +files_relabel_config_symlinks(systemd_tmpfiles_t) files_relabel_all_locks(systemd_tmpfiles_t) files_relabel_all_runtime_dirs(systemd_tmpfiles_t) files_relabel_all_tmp_dirs(systemd_tmpfiles_t) |