aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--policy/modules/system/init.if24
-rw-r--r--policy/modules/system/systemd.te3
2 files changed, 23 insertions, 4 deletions
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 03538310..b1b6ca2d 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -1400,7 +1400,7 @@ interface(`init_manage_pid_symlinks', `
######################################
## <summary>
-## Create and write files in the /run/systemd directory.
+## Create files in the /run/systemd directory.
## </summary>
## <param name="domain">
## <summary>
@@ -1408,12 +1408,30 @@ interface(`init_manage_pid_symlinks', `
## </summary>
## </param>
#
-interface(`init_create_write_pid_files', `
+interface(`init_create_pid_files', `
gen_require(`
type init_runtime_t;
')
- allow $1 init_runtime_t:file { create_file_perms write };
+ allow $1 init_runtime_t:file create_file_perms;
+')
+
+######################################
+## <summary>
+## Write files in the /run/systemd directory.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`init_write_pid_files', `
+ gen_require(`
+ type init_runtime_t;
+ ')
+
+ allow $1 init_runtime_t:file write_file_perms;
')
######################################
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index f0412af3..3edbc98e 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -283,10 +283,11 @@ files_search_pids(systemd_fstab_generator_t)
fstools_exec(systemd_fstab_generator_t)
-init_create_write_pid_files(systemd_fstab_generator_t)
+init_create_pid_files(systemd_fstab_generator_t)
init_manage_pid_dirs(systemd_fstab_generator_t)
init_manage_pid_symlinks(systemd_fstab_generator_t)
init_search_pids(systemd_fstab_generator_t)
+init_write_pid_files(systemd_fstab_generator_t)
kernel_read_kernel_sysctls(systemd_fstab_generator_t)