commit: 92e031a769ce70569deabf45172a76592f774d12
Author: Rahul Sandhu <rahul <AT> sandhuservices <DOT> dev>
AuthorDate: Thu Nov 28 01:38:38 2024 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Dec 15 00:19:19 2024 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=92e031a7
systemd_stream_connect_homed: new interface to access account info
systemd-homed provides a varlink API with a unix socket at
/run/systemd/userdb/io.systemd.Home to query user account records. As
quite a few things will need to be able to query this API for basic
functionality to work - such as `groups(1)` being able to operate on
systemd-homed user accounts - let's make an interface for this.
Signed-off-by: Rahul Sandhu <rahul <AT> sandhuservices.dev>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/system/systemd.if | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index 0d97cf0cd..1ddc9fba5 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -1136,6 +1136,25 @@ interface(`systemd_dbus_chat_homed',`
allow systemd_homed_t $1:dbus send_msg;
')
+########################################
+## <summary>
+## Connect to /run/systemd/userdb/io.systemd.Home to
+## query user account information.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`systemd_stream_connect_homed',`
+ gen_require(`
+ type systemd_homed_t;
+ ')
+
+ allow $1 systemd_homed_t:unix_stream_socket connectto;
+')
+
######################################
## <summary>
## Read and write systemd-homework semaphores.
