diff options
| -rw-r--r-- | policy/modules/kernel/filesystem.if | 37 | ||||
| -rw-r--r-- | policy/modules/system/systemd.te | 6 |
2 files changed, 43 insertions, 0 deletions
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if index 08ad5503..ae022b6c 100644 --- a/policy/modules/kernel/filesystem.if +++ b/policy/modules/kernel/filesystem.if @@ -604,6 +604,24 @@ interface(`fs_manage_autofs_symlinks',` ######################################## ## <summary> +## Get the attributes of binfmt_misc filesystems. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`fs_getattr_binfmt_misc_fs',` + gen_require(` + type binfmt_misc_fs_t; + ') + + allow $1 binfmt_misc_fs_t:filesystem getattr; +') + +######################################## +## <summary> ## Get the attributes of directories on ## binfmt_misc filesystems. ## </summary> @@ -624,6 +642,25 @@ interface(`fs_getattr_binfmt_misc_dirs',` ######################################## ## <summary> +## Check for permissions using access(2) of directories on +## binfmt_misc filesystems. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`fs_check_write_binfmt_misc_dirs',` + gen_require(` + type binfmt_misc_fs_t; + ') + + allow $1 binfmt_misc_fs_t:dir { getattr write }; +') + +######################################## +## <summary> ## Register an interpreter for new binary ## file types, using the kernel binfmt_misc ## support. diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index 6d07466e..63fef177 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -401,6 +401,7 @@ fs_search_cgroup_dirs(systemd_backlight_t) # kernel_read_kernel_sysctls(systemd_binfmt_t) +kernel_getattr_proc(systemd_binfmt_t) systemd_log_parse_environment(systemd_binfmt_t) @@ -409,6 +410,11 @@ files_read_etc_files(systemd_binfmt_t) fs_register_binary_executable_type(systemd_binfmt_t) +fs_getattr_binfmt_misc_fs(systemd_binfmt_t) +fs_check_write_binfmt_misc_dirs(systemd_binfmt_t) + +fs_getattr_cgroup(systemd_binfmt_t) +fs_search_cgroup_dirs(systemd_binfmt_t) ###################################### # |