commit: 0fc88387bdc52d40b6388336d655a4374271b049
Author: Jason Zaman <perfinion <AT> gentoo <DOT> org>
AuthorDate: Mon Dec 16 17:45:34 2019 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Dec 24 09:58:27 2019 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=0fc88387
Rename gentoo-specific *_var_run_t types to *_runtime_t.
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/admin/puppet.te | 2 +-
policy/modules/apps/qemu.if | 4 +--
policy/modules/apps/qemu.te | 4 +--
policy/modules/contrib/at.fc | 4 +--
policy/modules/contrib/at.te | 10 +++---
policy/modules/contrib/bitcoin.if | 4 +--
policy/modules/contrib/bitcoin.te | 4 +--
policy/modules/contrib/ceph.fc | 10 +++---
policy/modules/contrib/ceph.if | 13 ++++----
policy/modules/contrib/ceph.te | 10 +++---
policy/modules/contrib/dirsrv.fc | 4 +--
policy/modules/contrib/dirsrv.if | 18 +++++------
policy/modules/contrib/dirsrv.te | 22 ++++++-------
policy/modules/contrib/nginx.if | 4 +--
policy/modules/contrib/nginx.te | 10 +++---
policy/modules/contrib/phpfpm.fc | 4 +--
policy/modules/contrib/phpfpm.if | 8 ++---
policy/modules/contrib/phpfpm.te | 10 +++---
policy/modules/contrib/resolvconf.fc | 2 +-
policy/modules/contrib/resolvconf.if | 4 +--
policy/modules/contrib/resolvconf.te | 10 +++---
policy/modules/contrib/salt.fc | 10 +++---
policy/modules/contrib/salt.if | 8 ++---
policy/modules/contrib/salt.rst | 6 ++--
policy/modules/contrib/salt.te | 52 +++++++++++++++----------------
policy/modules/contrib/vde.fc | 2 +-
policy/modules/contrib/vde.if | 6 ++--
policy/modules/contrib/vde.te | 12 +++----
policy/modules/services/apache.te | 4 +--
policy/modules/services/clamav.te | 2 +-
policy/modules/services/courier.te | 2 +-
policy/modules/services/cron.fc | 4 +--
policy/modules/services/cron.rst | 2 +-
policy/modules/services/dbus.if | 8 ++---
policy/modules/services/fail2ban.te | 4 +--
policy/modules/services/ldap.te | 2 +-
policy/modules/services/munin.rst | 2 +-
policy/modules/services/mysql.if | 8 ++---
policy/modules/services/networkmanager.fc | 2 +-
policy/modules/services/networkmanager.te | 8 ++---
policy/modules/services/ntp.fc | 2 +-
policy/modules/system/authlogin.te | 2 +-
policy/modules/system/init.te | 4 +--
policy/modules/system/lvm.te | 2 +-
policy/modules/system/modutils.te | 4 +--
policy/modules/system/sysnetwork.fc | 4 +--
policy/modules/system/sysnetwork.te | 10 +++---
policy/modules/system/tmpfiles.fc | 2 +-
policy/modules/system/tmpfiles.if | 32 +++++++++----------
policy/modules/system/tmpfiles.rst | 2 +-
policy/modules/system/tmpfiles.te | 8 ++---
51 files changed, 188 insertions(+), 189 deletions(-)
diff --git a/policy/modules/admin/puppet.te b/policy/modules/admin/puppet.te
index 85c4ac40..75d03e76 100644
--- a/policy/modules/admin/puppet.te
+++ b/policy/modules/admin/puppet.te
@@ -355,7 +355,7 @@ ifdef(`distro_gentoo',`
rw_files_pattern(puppetmaster_t, puppet_log_t, puppet_log_t)
- manage_files_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t)
+ manage_files_pattern(puppetmaster_t, puppet_runtime_t, puppet_runtime_t)
optional_policy(`
usermanage_check_exec_passwd(puppetmaster_t)
diff --git a/policy/modules/apps/qemu.if b/policy/modules/apps/qemu.if
index e373c4d9..413e1347 100644
--- a/policy/modules/apps/qemu.if
+++ b/policy/modules/apps/qemu.if
@@ -427,8 +427,8 @@ interface(`qemu_entry_type',`
#
interface(`qemu_rw_pid_sock_files',`
gen_require(`
- type qemu_var_run_t;
+ type qemu_runtime_t;
')
- allow $1 qemu_var_run_t:sock_file rw_sock_file_perms;
+ allow $1 qemu_runtime_t:sock_file rw_sock_file_perms;
')
diff --git a/policy/modules/apps/qemu.te b/policy/modules/apps/qemu.te
index f99f2161..6188d362 100644
--- a/policy/modules/apps/qemu.te
+++ b/policy/modules/apps/qemu.te
@@ -90,9 +90,9 @@ ifdef(`distro_gentoo',`
allow qemu_t self:udp_socket create_socket_perms;
# Network related socket
- allow qemu_t qemu_var_run_t:sock_file manage_sock_file_perms;
+ allow qemu_t qemu_runtime_t:sock_file manage_sock_file_perms;
- files_pid_filetrans(qemu_t, qemu_var_run_t, sock_file)
+ files_pid_filetrans(qemu_t, qemu_runtime_t, sock_file)
optional_policy(`
vde_connect(qemu_t)
diff --git a/policy/modules/contrib/at.fc b/policy/modules/contrib/at.fc
index b3cf1863..39c83a99 100644
--- a/policy/modules/contrib/at.fc
+++ b/policy/modules/contrib/at.fc
@@ -1,9 +1,9 @@
/etc/rc\.d/init\.d/atd --
gen_context(system_u:object_r:atd_initrc_exec_t,s0)
/usr/bin/at -- gen_context(system_u:object_r:at_exec_t,s0)
-/usr/sbin/atd -- gen_context(system_u:object_r:atd_exec_t,s0)
+/usr/bin/atd -- gen_context(system_u:object_r:atd_exec_t,s0)
-/run/atd\.pid -- gen_context(system_u:object_r:atd_var_run_t,s0)
+/run/atd\.pid -- gen_context(system_u:object_r:atd_runtime_t,s0)
/var/spool/at(/.*)? gen_context(system_u:object_r:at_spool_t,s0)
/var/spool/at/atjobs(/.*)? gen_context(system_u:object_r:at_job_t,s0)
diff --git a/policy/modules/contrib/at.te b/policy/modules/contrib/at.te
index c28a9e7b..b0900cbf 100644
--- a/policy/modules/contrib/at.te
+++ b/policy/modules/contrib/at.te
@@ -21,8 +21,8 @@ init_daemon_domain(atd_t, atd_exec_t)
type atd_initrc_exec_t;
init_script_file(atd_initrc_exec_t)
-type atd_var_run_t;
-files_pid_file(atd_var_run_t)
+type atd_runtime_t alias atd_var_run_t;
+files_pid_file(atd_runtime_t)
########################################
#
@@ -39,8 +39,8 @@ list_dirs_pattern(atd_t, at_spool_t, at_job_t)
manage_files_pattern(atd_t, at_job_log_t, at_job_log_t)
-manage_files_pattern(atd_t, atd_var_run_t, atd_var_run_t)
-files_pid_filetrans(atd_t, atd_var_run_t, file)
+manage_files_pattern(atd_t, atd_runtime_t, atd_runtime_t)
+files_pid_filetrans(atd_t, atd_runtime_t, file)
kernel_read_kernel_sysctls(atd_t)
@@ -81,7 +81,7 @@ allow at_t at_spool_t:dir search_dir_perms;
allow at_t atd_t:process signal;
-allow at_t atd_var_run_t:file read_file_perms;
+allow at_t atd_runtime_t:file read_file_perms;
domain_use_interactive_fds(at_t)
diff --git a/policy/modules/contrib/bitcoin.if
b/policy/modules/contrib/bitcoin.if
index 9c7ca8da..7e00c963 100644
--- a/policy/modules/contrib/bitcoin.if
+++ b/policy/modules/contrib/bitcoin.if
@@ -19,7 +19,7 @@ interface(`bitcoin_admin',`
gen_require(`
type bitcoin_t;
type bitcoin_etc_t, bitcoin_tmp_t, bitcoin_log_t;
- type bitcoin_var_lib_t, bitcoin_var_run_t;
+ type bitcoin_var_lib_t, bitcoin_runtime_t;
type bitcoin_initrc_exec_t;
')
@@ -41,5 +41,5 @@ interface(`bitcoin_admin',`
admin_pattern($1, bitcoin_var_lib_t)
files_list_pids($1)
- admin_pattern($1, bitcoin_var_run_t)
+ admin_pattern($1, bitcoin_runtime_t)
')
diff --git a/policy/modules/contrib/bitcoin.te
b/policy/modules/contrib/bitcoin.te
index 672516e9..c5667519 100644
--- a/policy/modules/contrib/bitcoin.te
+++ b/policy/modules/contrib/bitcoin.te
@@ -31,8 +31,8 @@ type bitcoin_var_lib_t;
files_type(bitcoin_var_lib_t)
init_script_readable_type(bitcoin_var_lib_t)
-type bitcoin_var_run_t;
-files_pid_file(bitcoin_var_run_t)
+type bitcoin_runtime_t alias bitcoin_var_run_t;
+files_pid_file(bitcoin_runtime_t)
type bitcoin_tmp_t;
files_tmp_file(bitcoin_tmp_t)
diff --git a/policy/modules/contrib/ceph.fc b/policy/modules/contrib/ceph.fc
index 8e2e1799..4d1db681 100644
--- a/policy/modules/contrib/ceph.fc
+++ b/policy/modules/contrib/ceph.fc
@@ -23,8 +23,8 @@
/var/log/ceph(/.*)? gen_context(system_u:object_r:ceph_log_t,s0)
-/run/ceph -d gen_context(system_u:object_r:ceph_var_run_t,s0)
-/run/ceph/ceph-osd.*
gen_context(system_u:object_r:ceph_osd_var_run_t,s0)
-/run/ceph/ceph-mon.*
gen_context(system_u:object_r:ceph_mon_var_run_t,s0)
-/run/ceph/ceph-mds.*
gen_context(system_u:object_r:ceph_mds_var_run_t,s0)
-/run/ceph/mds.* --
gen_context(system_u:object_r:ceph_mds_var_run_t,s0)
+/run/ceph -d gen_context(system_u:object_r:ceph_runtime_t,s0)
+/run/ceph/ceph-osd.*
gen_context(system_u:object_r:ceph_osd_runtime_t,s0)
+/run/ceph/ceph-mon.*
gen_context(system_u:object_r:ceph_mon_runtime_t,s0)
+/run/ceph/ceph-mds.*
gen_context(system_u:object_r:ceph_mds_runtime_t,s0)
+/run/ceph/mds.* --
gen_context(system_u:object_r:ceph_mds_runtime_t,s0)
diff --git a/policy/modules/contrib/ceph.if b/policy/modules/contrib/ceph.if
index c922531b..9ff98e6f 100644
--- a/policy/modules/contrib/ceph.if
+++ b/policy/modules/contrib/ceph.if
@@ -17,7 +17,7 @@ template(`ceph_domain_template',`
attribute cephpidfile;
attribute_role ceph_roles;
- type ceph_var_run_t;
+ type ceph_runtime_t;
')
type ceph_$1_t, cephdomain;
@@ -28,8 +28,9 @@ template(`ceph_domain_template',`
type ceph_$1_data_t, cephdata;
files_type(ceph_$1_data_t)
- type ceph_$1_var_run_t, cephpidfile;
- files_pid_file(ceph_$1_var_run_t)
+ type ceph_$1_runtime_t, cephpidfile;
+ typealias ceph_$1_runtime_t alias ceph_$1_var_run_t;
+ files_pid_file(ceph_$1_runtime_t)
########################################
#
@@ -37,12 +38,12 @@ template(`ceph_domain_template',`
#
# Rules which cannot be made part of the domain
- allow ceph_$1_t ceph_$1_var_run_t:file manage_file_perms;
- allow ceph_$1_t ceph_$1_var_run_t:sock_file manage_file_perms;
+ allow ceph_$1_t ceph_$1_runtime_t:file manage_file_perms;
+ allow ceph_$1_t ceph_$1_runtime_t:sock_file manage_file_perms;
allow ceph_$1_t ceph_$1_data_t:dir manage_dir_perms;
allow ceph_$1_t ceph_$1_data_t:file manage_file_perms;
- filetrans_pattern(ceph_$1_t, ceph_var_run_t, ceph_$1_var_run_t, { file
sock_file })
+ filetrans_pattern(ceph_$1_t, ceph_runtime_t, ceph_$1_runtime_t, { file
sock_file })
files_var_lib_filetrans(ceph_$1_t, ceph_$1_data_t, { file dir })
')
diff --git a/policy/modules/contrib/ceph.te b/policy/modules/contrib/ceph.te
index 9704dd41..94ebe44f 100644
--- a/policy/modules/contrib/ceph.te
+++ b/policy/modules/contrib/ceph.te
@@ -28,8 +28,8 @@ logging_log_file(ceph_log_t)
type ceph_var_lib_t;
files_type(ceph_var_lib_t)
-type ceph_var_run_t;
-files_pid_file(ceph_var_run_t)
+type ceph_runtime_t alias ceph_var_run_t;
+files_pid_file(ceph_runtime_t)
#########################################
#
@@ -48,8 +48,8 @@ allow cephdomain ceph_log_t:file { create_file_perms
rw_file_perms };
allow cephdomain ceph_var_lib_t:dir search_dir_perms;
allow cephdomain self:netlink_route_socket { rw_netlink_socket_perms };
allow cephdomain self:tcp_socket { create_socket_perms listen accept };
-allow cephdomain ceph_var_run_t:file manage_file_perms;
-allow cephdomain ceph_var_run_t:dir manage_dir_perms;
+allow cephdomain ceph_runtime_t:file manage_file_perms;
+allow cephdomain ceph_runtime_t:dir manage_dir_perms;
kernel_read_system_state(cephdomain)
@@ -60,7 +60,7 @@ corenet_tcp_connect_all_unreserved_ports(cephdomain)
files_read_etc_files(cephdomain)
files_search_pids(cephdomain)
files_search_var_lib(cephdomain)
-files_pid_filetrans(cephdomain, ceph_var_run_t, dir)
+files_pid_filetrans(cephdomain, ceph_runtime_t, dir)
fs_getattr_all_fs(cephdomain)
diff --git a/policy/modules/contrib/dirsrv.fc b/policy/modules/contrib/dirsrv.fc
index 88b1a6eb..3a33d632 100644
--- a/policy/modules/contrib/dirsrv.fc
+++ b/policy/modules/contrib/dirsrv.fc
@@ -6,7 +6,7 @@
/var/lock/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_var_lock_t,s0)
/var/log/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_var_log_t,s0)
/var/log/dirsrv/ldap-agent.log
gen_context(system_u:object_r:dirsrv_snmp_var_log_t,s0)
-/run/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_var_run_t,s0)
-/run/ldap-agent.pid gen_context(system_u:object_r:dirsrv_snmp_var_run_t,s0)
+/run/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_runtime_t,s0)
+/run/ldap-agent.pid gen_context(system_u:object_r:dirsrv_snmp_runtime_t,s0)
/etc/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_config_t,s0)
diff --git a/policy/modules/contrib/dirsrv.if b/policy/modules/contrib/dirsrv.if
index cbe9ecaf..8c697fc9 100644
--- a/policy/modules/contrib/dirsrv.if
+++ b/policy/modules/contrib/dirsrv.if
@@ -112,11 +112,11 @@ interface(`dirsrv_manage_var_lib',`
#
interface(`dirsrv_manage_var_run',`
gen_require(`
- type dirsrv_var_run_t;
+ type dirsrv_runtime_t;
')
- allow $1 dirsrv_var_run_t:dir manage_dir_perms;
- allow $1 dirsrv_var_run_t:file manage_file_perms;
- allow $1 dirsrv_var_run_t:sock_file manage_file_perms;
+ allow $1 dirsrv_runtime_t:dir manage_dir_perms;
+ allow $1 dirsrv_runtime_t:file manage_file_perms;
+ allow $1 dirsrv_runtime_t:sock_file manage_file_perms;
')
######################################
@@ -131,10 +131,10 @@ interface(`dirsrv_manage_var_run',`
#
interface(`dirsrv_pid_filetrans',`
gen_require(`
- type dirsrv_var_run_t;
+ type dirsrv_runtime_t;
')
# Allow creating a dir in /var/run with this type
- files_pid_filetrans($1, dirsrv_var_run_t, dir)
+ files_pid_filetrans($1, dirsrv_runtime_t, dir)
')
#######################################
@@ -149,10 +149,10 @@ interface(`dirsrv_pid_filetrans',`
#
interface(`dirsrv_read_var_run',`
gen_require(`
- type dirsrv_var_run_t;
+ type dirsrv_runtime_t;
')
- allow $1 dirsrv_var_run_t:dir list_dir_perms;
- allow $1 dirsrv_var_run_t:file read_file_perms;
+ allow $1 dirsrv_runtime_t:dir list_dir_perms;
+ allow $1 dirsrv_runtime_t:file read_file_perms;
')
########################################
diff --git a/policy/modules/contrib/dirsrv.te b/policy/modules/contrib/dirsrv.te
index 1a8b77a1..e7c8d06e 100644
--- a/policy/modules/contrib/dirsrv.te
+++ b/policy/modules/contrib/dirsrv.te
@@ -32,12 +32,12 @@ type dirsrv_snmp_var_log_t;
logging_log_file(dirsrv_snmp_var_log_t)
# pid files
-type dirsrv_var_run_t;
-files_pid_file(dirsrv_var_run_t)
+type dirsrv_runtime_t alias dirsrv_var_run_t;
+files_pid_file(dirsrv_runtime_t)
# snmp pid file
-type dirsrv_snmp_var_run_t;
-files_pid_file(dirsrv_snmp_var_run_t)
+type dirsrv_snmp_runtime_t alias dirsrv_snmp_var_run_t;
+files_pid_file(dirsrv_snmp_runtime_t)
# lock files
type dirsrv_var_lock_t;
@@ -95,11 +95,11 @@ allow dirsrv_t dirsrv_var_log_t:dir { setattr };
logging_log_filetrans(dirsrv_t,dirsrv_var_log_t,{ sock_file file dir })
# pid files
-manage_files_pattern(dirsrv_t, dirsrv_var_run_t, dirsrv_var_run_t)
-files_pid_filetrans(dirsrv_t, dirsrv_var_run_t, { file sock_file })
+manage_files_pattern(dirsrv_t, dirsrv_runtime_t, dirsrv_runtime_t)
+files_pid_filetrans(dirsrv_t, dirsrv_runtime_t, { file sock_file })
# ldapi socket
-manage_sock_files_pattern(dirsrv_t, dirsrv_var_run_t, dirsrv_var_run_t)
+manage_sock_files_pattern(dirsrv_t, dirsrv_runtime_t, dirsrv_runtime_t)
# lock files
manage_files_pattern(dirsrv_t, dirsrv_var_lock_t, dirsrv_var_lock_t)
@@ -175,7 +175,7 @@ files_manage_var_files(dirsrv_snmp_t)
rw_files_pattern(dirsrv_snmp_t, dirsrv_tmpfs_t, dirsrv_tmpfs_t)
# stats file
-read_files_pattern(dirsrv_snmp_t, dirsrv_var_run_t, dirsrv_var_run_t)
+read_files_pattern(dirsrv_snmp_t, dirsrv_runtime_t, dirsrv_runtime_t)
# process stuff
allow dirsrv_snmp_t self:capability { dac_override dac_read_search };
@@ -184,9 +184,9 @@ allow dirsrv_snmp_t self:capability { dac_override
dac_read_search };
read_files_pattern(dirsrv_snmp_t, dirsrv_config_t, dirsrv_config_t)
# pid file
-manage_files_pattern(dirsrv_snmp_t, dirsrv_snmp_var_run_t,
dirsrv_snmp_var_run_t)
-files_pid_filetrans(dirsrv_snmp_t, dirsrv_snmp_var_run_t, { file sock_file })
-search_dirs_pattern(dirsrv_snmp_t, dirsrv_var_run_t, dirsrv_var_run_t)
+manage_files_pattern(dirsrv_snmp_t, dirsrv_snmp_runtime_t,
dirsrv_snmp_runtime_t)
+files_pid_filetrans(dirsrv_snmp_t, dirsrv_snmp_runtime_t, { file sock_file })
+search_dirs_pattern(dirsrv_snmp_t, dirsrv_runtime_t, dirsrv_runtime_t)
# log file
manage_files_pattern(dirsrv_snmp_t, dirsrv_var_log_t, dirsrv_snmp_var_log_t);
diff --git a/policy/modules/contrib/nginx.if b/policy/modules/contrib/nginx.if
index ebef6e75..dbd9bcbe 100644
--- a/policy/modules/contrib/nginx.if
+++ b/policy/modules/contrib/nginx.if
@@ -81,7 +81,7 @@ interface(`nginx_domtrans',`
#
interface(`nginx_admin',`
gen_require(`
- type nginx_t, nginx_conf_t, nginx_log_t, nginx_var_lib_t,
nginx_var_run_t;
+ type nginx_t, nginx_conf_t, nginx_log_t, nginx_var_lib_t,
nginx_runtime_t;
type nginx_exec_t;
')
@@ -100,5 +100,5 @@ interface(`nginx_admin',`
admin_pattern($1, nginx_log_t)
files_list_pids($1)
- admin_pattern($1, nginx_var_run_t)
+ admin_pattern($1, nginx_runtime_t)
')
diff --git a/policy/modules/contrib/nginx.te b/policy/modules/contrib/nginx.te
index be59babb..1818be85 100644
--- a/policy/modules/contrib/nginx.te
+++ b/policy/modules/contrib/nginx.te
@@ -69,8 +69,8 @@ type nginx_var_lib_t;
files_type(nginx_var_lib_t)
# pid files
-type nginx_var_run_t;
-files_pid_file(nginx_var_run_t)
+type nginx_runtime_t alias nginx_var_run_t;
+files_pid_file(nginx_runtime_t)
########################################
#
@@ -92,9 +92,9 @@ logging_log_filetrans(nginx_t, nginx_log_t, { file dir })
# pid file
-manage_dirs_pattern(nginx_t, nginx_var_run_t, nginx_var_run_t)
-manage_files_pattern(nginx_t, nginx_var_run_t, nginx_var_run_t)
-files_pid_filetrans(nginx_t, nginx_var_run_t, file)
+manage_dirs_pattern(nginx_t, nginx_runtime_t, nginx_runtime_t)
+manage_files_pattern(nginx_t, nginx_runtime_t, nginx_runtime_t)
+files_pid_filetrans(nginx_t, nginx_runtime_t, file)
# tmp files
manage_files_pattern(nginx_t, nginx_tmp_t, nginx_tmp_t)
diff --git a/policy/modules/contrib/phpfpm.fc b/policy/modules/contrib/phpfpm.fc
index f43358d7..da28e772 100644
--- a/policy/modules/contrib/phpfpm.fc
+++ b/policy/modules/contrib/phpfpm.fc
@@ -1,5 +1,5 @@
/usr/lib/php.*/bin/php-fpm
gen_context(system_u:object_r:phpfpm_exec_t,s0)
-/run/php*-fpm/*.sock
gen_context(system_u:object_r:phpfpm_var_run_t,s0)
+/run/php*-fpm/*.sock
gen_context(system_u:object_r:phpfpm_runtime_t,s0)
/var/log/php-fpm.log
gen_context(system_u:object_r:phpfpm_log_t,s0)
-/run/php-fpm.pid
gen_context(system_u:object_r:phpfpm_var_run_t,s0)
+/run/php-fpm.pid
gen_context(system_u:object_r:phpfpm_runtime_t,s0)
diff --git a/policy/modules/contrib/phpfpm.if b/policy/modules/contrib/phpfpm.if
index fee2c174..38f7c3e7 100644
--- a/policy/modules/contrib/phpfpm.if
+++ b/policy/modules/contrib/phpfpm.if
@@ -13,7 +13,7 @@
interface(`phpfpm_admin',`
gen_require(`
type phpfpm_t;
- type phpfpm_log_t, phpfpm_tmp_t, phpfpm_var_run_t;
+ type phpfpm_log_t, phpfpm_tmp_t, phpfpm_runtime_t;
')
allow $1 phpfpm_t:process { ptrace signal_perms };
@@ -26,7 +26,7 @@ interface(`phpfpm_admin',`
admin_pattern($1, phpfpm_tmp_t)
files_list_pids($1)
- admin_pattern($1, phpfpm_var_run_t)
+ admin_pattern($1, phpfpm_runtime_t)
')
########################################
@@ -42,7 +42,7 @@ interface(`phpfpm_admin',`
#
interface(`phpfpm_stream_connect',`
gen_require(`
- type phpfpm_t, phpfpm_var_run_t;
+ type phpfpm_t, phpfpm_runtime_t;
')
- stream_connect_pattern($1, phpfpm_var_run_t, phpfpm_var_run_t, phpfpm_t)
+ stream_connect_pattern($1, phpfpm_runtime_t, phpfpm_runtime_t, phpfpm_t)
')
diff --git a/policy/modules/contrib/phpfpm.te b/policy/modules/contrib/phpfpm.te
index 826ba859..aefad850 100644
--- a/policy/modules/contrib/phpfpm.te
+++ b/policy/modules/contrib/phpfpm.te
@@ -19,8 +19,8 @@ init_daemon_domain(phpfpm_t, phpfpm_exec_t)
type phpfpm_tmp_t;
files_tmp_file(phpfpm_tmp_t)
-type phpfpm_var_run_t;
-files_pid_file(phpfpm_var_run_t)
+type phpfpm_runtime_t alias phpfpm_var_run_t;
+files_pid_file(phpfpm_runtime_t)
type phpfpm_log_t;
logging_log_file(phpfpm_log_t)
@@ -45,10 +45,10 @@ manage_files_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t)
manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t)
files_tmp_filetrans(phpfpm_t, phpfpm_tmp_t, {file dir})
-manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
-files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file })
+manage_files_pattern(phpfpm_t, phpfpm_runtime_t, phpfpm_runtime_t)
+files_pid_filetrans(phpfpm_t, phpfpm_runtime_t, { file sock_file })
-manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t)
+manage_sock_files_pattern(phpfpm_t, phpfpm_runtime_t, phpfpm_runtime_t)
kernel_read_kernel_sysctls(phpfpm_t)
diff --git a/policy/modules/contrib/resolvconf.fc
b/policy/modules/contrib/resolvconf.fc
index 651bbe0a..4e5df895 100644
--- a/policy/modules/contrib/resolvconf.fc
+++ b/policy/modules/contrib/resolvconf.fc
@@ -4,4 +4,4 @@
/usr/sbin/resolvconf --
gen_context(system_u:object_r:resolvconf_exec_t,s0)
-/run/resolvconf(/.*)?
gen_context(system_u:object_r:resolvconf_var_run_t,s0)
+/run/resolvconf(/.*)?
gen_context(system_u:object_r:resolvconf_runtime_t,s0)
diff --git a/policy/modules/contrib/resolvconf.if
b/policy/modules/contrib/resolvconf.if
index 7a93eb6c..c6e53fb9 100644
--- a/policy/modules/contrib/resolvconf.if
+++ b/policy/modules/contrib/resolvconf.if
@@ -95,8 +95,8 @@ interface(`resolvconf_exec',`
#
interface(`resolvconf_generic_run_filetrans_run',`
gen_require(`
- type resolvconf_var_run_t;
+ type resolvconf_runtime_t;
')
- files_pid_filetrans($1, resolvconf_var_run_t, $2, $3)
+ files_pid_filetrans($1, resolvconf_runtime_t, $2, $3)
')
diff --git a/policy/modules/contrib/resolvconf.te
b/policy/modules/contrib/resolvconf.te
index 58bb165d..18738a1f 100644
--- a/policy/modules/contrib/resolvconf.te
+++ b/policy/modules/contrib/resolvconf.te
@@ -11,8 +11,8 @@ attribute resolvconf_client;
type resolvconf_conf_t;
files_config_file(resolvconf_conf_t)
-type resolvconf_var_run_t;
-files_pid_file(resolvconf_var_run_t)
+type resolvconf_runtime_t alias resolvconf_var_run_t;
+files_pid_file(resolvconf_runtime_t)
#########################################
#
@@ -22,13 +22,13 @@ files_pid_file(resolvconf_var_run_t)
allow resolvconf_t self:fifo_file manage_fifo_file_perms;
allow resolvconf_t resolvconf_conf_t:file read_file_perms;
-manage_dirs_pattern(resolvconf_t, resolvconf_var_run_t, resolvconf_var_run_t)
-manage_files_pattern(resolvconf_t, resolvconf_var_run_t, resolvconf_var_run_t)
+manage_dirs_pattern(resolvconf_t, resolvconf_runtime_t, resolvconf_runtime_t)
+manage_files_pattern(resolvconf_t, resolvconf_runtime_t, resolvconf_runtime_t)
corecmd_exec_bin(resolvconf_t)
corecmd_exec_shell(resolvconf_t)
-files_pid_filetrans(resolvconf_t, resolvconf_var_run_t, { dir file })
+files_pid_filetrans(resolvconf_t, resolvconf_runtime_t, { dir file })
files_read_etc_files(resolvconf_t)
miscfiles_read_localization(resolvconf_t)
diff --git a/policy/modules/contrib/salt.fc b/policy/modules/contrib/salt.fc
index ccc8028f..1dbef661 100644
--- a/policy/modules/contrib/salt.fc
+++ b/policy/modules/contrib/salt.fc
@@ -16,11 +16,11 @@
/var/log/salt/master --
gen_context(system_u:object_r:salt_master_log_t,s0)
/var/log/salt/minion --
gen_context(system_u:object_r:salt_minion_log_t,s0)
-/run/salt -d gen_context(system_u:object_r:salt_var_run_t,s0)
-/run/salt/master(/.*)? gen_context(system_u:object_r:salt_master_var_run_t,s0)
-/run/salt/minion(/.*)? gen_context(system_u:object_r:salt_minion_var_run_t,s0)
-/run/salt-master\.pid --
gen_context(system_u:object_r:salt_master_var_run_t,s0)
-/run/salt-minion\.pid --
gen_context(system_u:object_r:salt_minion_var_run_t,s0)
+/run/salt -d gen_context(system_u:object_r:salt_runtime_t,s0)
+/run/salt/master(/.*)? gen_context(system_u:object_r:salt_master_runtime_t,s0)
+/run/salt/minion(/.*)? gen_context(system_u:object_r:salt_minion_runtime_t,s0)
+/run/salt-master\.pid --
gen_context(system_u:object_r:salt_master_runtime_t,s0)
+/run/salt-minion\.pid --
gen_context(system_u:object_r:salt_minion_runtime_t,s0)
/var/cache/salt -d gen_context(system_u:object_r:salt_cache_t,s0)
/var/cache/salt/master(/.*)?
gen_context(system_u:object_r:salt_master_cache_t,s0)
diff --git a/policy/modules/contrib/salt.if b/policy/modules/contrib/salt.if
index 27fefaef..a26d6380 100644
--- a/policy/modules/contrib/salt.if
+++ b/policy/modules/contrib/salt.if
@@ -21,8 +21,8 @@ interface(`salt_admin_master',`
type salt_master_initrc_exec_t;
type salt_master_exec_t;
type salt_etc_t;
- type salt_var_run_t;
- type salt_master_var_run_t;
+ type salt_runtime_t;
+ type salt_master_runtime_t;
attribute_role salt_master_roles;
')
@@ -40,8 +40,8 @@ interface(`salt_admin_master',`
files_list_etc($1)
admin_pattern($1, salt_etc_t, salt_etc_t)
- allow $1 salt_var_run_t:dir search_dir_perms;
- stream_connect_pattern($1, salt_master_var_run_t,
salt_master_var_run_t, salt_master_t)
+ allow $1 salt_runtime_t:dir search_dir_perms;
+ stream_connect_pattern($1, salt_master_runtime_t,
salt_master_runtime_t, salt_master_t)
')
#########################################
diff --git a/policy/modules/contrib/salt.rst b/policy/modules/contrib/salt.rst
index 0268b95f..ad4ce7d6 100644
--- a/policy/modules/contrib/salt.rst
+++ b/policy/modules/contrib/salt.rst
@@ -124,13 +124,13 @@ salt_master_log_t
salt_minion_log_t
is used for the Salt minion log file (*/var/log/salt/minion*)
-salt_var_run_t
+salt_runtime_t
is used for the parent directory for Salt run-time files (*/var/run/salt*)
-salt_master_var_run_t
+salt_master_runtime_t
is used for the Salt master variable run-time files (*/var/run/salt/master*)
-salt_minion_var_run_t
+salt_minion_runtime_t
is used for the Salt minion variable run-time files (*/var/run/salt/minion*)
CONFIGURATION FILES
diff --git a/policy/modules/contrib/salt.te b/policy/modules/contrib/salt.te
index 2eb7b7db..5741c27a 100644
--- a/policy/modules/contrib/salt.te
+++ b/policy/modules/contrib/salt.te
@@ -48,9 +48,9 @@ files_tmp_file(salt_master_tmp_t)
type salt_master_tmpfs_t;
files_tmpfs_file(salt_master_tmpfs_t)
-type salt_master_var_run_t;
-init_daemon_pid_file(salt_master_var_run_t, file, "salt-master.pid")
-files_pid_file(salt_master_var_run_t)
+type salt_master_runtime_t alias salt_master_var_run_t;
+init_daemon_pid_file(salt_master_runtime_t, file, "salt-master.pid")
+files_pid_file(salt_master_runtime_t)
type salt_minion_t;
type salt_minion_exec_t;
@@ -75,9 +75,9 @@ files_tmp_file(salt_minion_tmp_t)
type salt_minion_tmpfs_t;
files_tmpfs_file(salt_minion_tmpfs_t)
-type salt_minion_var_run_t;
-init_daemon_pid_file(salt_minion_var_run_t, file, "salt-minion.pid")
-files_pid_file(salt_minion_var_run_t)
+type salt_minion_runtime_t alias salt_minion_var_run_t;
+init_daemon_pid_file(salt_minion_runtime_t, file, "salt-minion.pid")
+files_pid_file(salt_minion_runtime_t)
type salt_cache_t;
files_type(salt_cache_t)
@@ -94,8 +94,8 @@ files_type(salt_sls_t)
type salt_pki_t;
files_type(salt_pki_t)
-type salt_var_run_t;
-files_pid_file(salt_var_run_t)
+type salt_runtime_t alias salt_var_run_t;
+files_pid_file(salt_runtime_t)
#########################################
#
@@ -150,11 +150,11 @@ can_exec(salt_master_t, salt_master_tmp_t)
allow salt_master_t salt_master_tmpfs_t:file { manage_file_perms map };
fs_tmpfs_filetrans(salt_master_t, salt_master_tmpfs_t, file)
-# salt_master_var_run_t
-allow salt_master_t salt_master_var_run_t:file manage_file_perms;
-allow salt_master_t salt_master_var_run_t:sock_file manage_sock_file_perms;
-manage_dirs_pattern(salt_master_t, salt_var_run_t, salt_master_var_run_t)
-filetrans_pattern(salt_master_t, salt_var_run_t, salt_master_var_run_t, dir)
+# salt_master_runtime_t
+allow salt_master_t salt_master_runtime_t:file manage_file_perms;
+allow salt_master_t salt_master_runtime_t:sock_file manage_sock_file_perms;
+manage_dirs_pattern(salt_master_t, salt_runtime_t, salt_master_runtime_t)
+filetrans_pattern(salt_master_t, salt_runtime_t, salt_master_runtime_t, dir)
# salt_pki_t
create_dirs_pattern(salt_master_t, salt_etc_t, salt_pki_t)
@@ -164,10 +164,10 @@ filetrans_pattern(salt_master_t, salt_etc_t, salt_pki_t,
dir, "pki")
read_files_pattern(salt_master_t, salt_sls_t, salt_sls_t)
allow salt_master_t salt_sls_t:dir list_dir_perms;
-# salt_var_run_t
-allow salt_master_t salt_var_run_t:dir create_dir_perms;
-files_pid_filetrans(salt_master_t, salt_var_run_t, dir)
-files_pid_filetrans(salt_master_t, salt_master_var_run_t, file,
"salt-master.pid")
+# salt_runtime_t
+allow salt_master_t salt_runtime_t:dir create_dir_perms;
+files_pid_filetrans(salt_master_t, salt_runtime_t, dir)
+files_pid_filetrans(salt_master_t, salt_master_runtime_t, file,
"salt-master.pid")
kernel_read_network_state(salt_master_t)
kernel_read_software_raid_state(salt_master_t)
@@ -269,20 +269,20 @@ can_exec(salt_minion_t, salt_minion_tmp_t)
allow salt_minion_t salt_minion_tmpfs_t:file { manage_file_perms map };
fs_tmpfs_filetrans(salt_minion_t, salt_minion_tmpfs_t, file)
-# salt_minion_var_run_t
-allow salt_minion_t salt_minion_var_run_t:file manage_file_perms;
-allow salt_minion_t salt_minion_var_run_t:sock_file manage_sock_file_perms;
-manage_dirs_pattern(salt_minion_t, salt_var_run_t, salt_minion_var_run_t)
-filetrans_pattern(salt_minion_t, salt_var_run_t, salt_minion_var_run_t, dir)
+# salt_minion_runtime_t
+allow salt_minion_t salt_minion_runtime_t:file manage_file_perms;
+allow salt_minion_t salt_minion_runtime_t:sock_file manage_sock_file_perms;
+manage_dirs_pattern(salt_minion_t, salt_runtime_t, salt_minion_runtime_t)
+filetrans_pattern(salt_minion_t, salt_runtime_t, salt_minion_runtime_t, dir)
# salt_pki_t
create_dirs_pattern(salt_minion_t, salt_etc_t, salt_pki_t)
filetrans_pattern(salt_minion_t, salt_etc_t, salt_pki_t, dir, "pki")
-# salt_var_run_t
-allow salt_minion_t salt_var_run_t:dir create_dir_perms;
-files_pid_filetrans(salt_minion_t, salt_var_run_t, dir)
-files_pid_filetrans(salt_minion_t, salt_minion_var_run_t, file,
"salt-minion.pid")
+# salt_runtime_t
+allow salt_minion_t salt_runtime_t:dir create_dir_perms;
+files_pid_filetrans(salt_minion_t, salt_runtime_t, dir)
+files_pid_filetrans(salt_minion_t, salt_minion_runtime_t, file,
"salt-minion.pid")
kernel_read_network_state(salt_minion_t)
kernel_read_software_raid_state(salt_minion_t)
diff --git a/policy/modules/contrib/vde.fc b/policy/modules/contrib/vde.fc
index fa0b6b28..bea4fd72 100644
--- a/policy/modules/contrib/vde.fc
+++ b/policy/modules/contrib/vde.fc
@@ -1,5 +1,5 @@
/etc/rc\.d/init\.d/vde --
gen_context(system_u:object_r:vde_initrc_exec_t,s0)
/usr/bin/vde_switch -- gen_context(system_u:object_r:vde_exec_t,s0)
/usr/sbin/vde_tunctl -- gen_context(system_u:object_r:vde_exec_t,s0)
-/run/vde\.ctl(/.*)? gen_context(system_u:object_r:vde_var_run_t,s0)
+/run/vde\.ctl(/.*)? gen_context(system_u:object_r:vde_runtime_t,s0)
/tmp/vde.[0-9-]* -s gen_context(system_u:object_r:vde_tmp_t,s0)
diff --git a/policy/modules/contrib/vde.if b/policy/modules/contrib/vde.if
index 00b31b4c..24bc31a9 100644
--- a/policy/modules/contrib/vde.if
+++ b/policy/modules/contrib/vde.if
@@ -19,7 +19,7 @@
interface(`vde_role',`
gen_require(`
type vde_t, vde_tmp_t;
- type vde_var_run_t;
+ type vde_runtime_t;
type vde_initrc_exec_t, vde_exec_t;
')
@@ -49,10 +49,10 @@ interface(`vde_role',`
#
interface(`vde_connect',`
gen_require(`
- type vde_t, vde_var_run_t, vde_tmp_t;
+ type vde_t, vde_runtime_t, vde_tmp_t;
')
- allow $1 vde_var_run_t:sock_file write_sock_file_perms;
+ allow $1 vde_runtime_t:sock_file write_sock_file_perms;
allow $1 vde_t:unix_stream_socket { connectto };
allow $1 vde_t:unix_dgram_socket { sendto };
allow vde_t $1:unix_dgram_socket { sendto };
diff --git a/policy/modules/contrib/vde.te b/policy/modules/contrib/vde.te
index 56f668d7..8e935560 100644
--- a/policy/modules/contrib/vde.te
+++ b/policy/modules/contrib/vde.te
@@ -15,8 +15,8 @@ init_script_file(vde_initrc_exec_t)
type vde_var_lib_t;
files_type(vde_var_lib_t)
-type vde_var_run_t;
-files_pid_file(vde_var_run_t)
+type vde_runtime_t alias vde_var_run_t;
+files_pid_file(vde_runtime_t)
type vde_tmp_t;
files_tmp_file(vde_tmp_t)
@@ -34,10 +34,10 @@ allow vde_t self:unix_stream_socket {
create_stream_socket_perms connectto };
allow vde_t self:unix_dgram_socket create_socket_perms;
files_tmp_filetrans(vde_t, vde_tmp_t, sock_file)
-manage_dirs_pattern(vde_t, vde_var_run_t, vde_var_run_t)
-manage_files_pattern(vde_t, vde_var_run_t, vde_var_run_t)
-manage_sock_files_pattern(vde_t, vde_var_run_t, vde_var_run_t)
-files_pid_filetrans(vde_t, vde_var_run_t, { dir file sock_file
unix_dgram_socket })
+manage_dirs_pattern(vde_t, vde_runtime_t, vde_runtime_t)
+manage_files_pattern(vde_t, vde_runtime_t, vde_runtime_t)
+manage_sock_files_pattern(vde_t, vde_runtime_t, vde_runtime_t)
+files_pid_filetrans(vde_t, vde_runtime_t, { dir file sock_file
unix_dgram_socket })
files_read_etc_files(vde_t)
diff --git a/policy/modules/services/apache.te
b/policy/modules/services/apache.te
index 715cc2d6..bda92f4a 100644
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -1487,8 +1487,8 @@ ifdef(`distro_gentoo',`
## </desc>
gen_tunable(hiawatha_httpd, false)
-init_daemon_pid_file(httpd_var_run_t, dir, "apache_ssl_mutex")
-init_daemon_pid_file(httpd_var_run_t, dir, "apache2")
+init_daemon_pid_file(httpd_runtime_t, dir, "apache_ssl_mutex")
+init_daemon_pid_file(httpd_runtime_t, dir, "apache2")
tunable_policy(`hiawatha_httpd',`
# bug 513362
diff --git a/policy/modules/services/clamav.te
b/policy/modules/services/clamav.te
index 6ceaf130..334ae633 100644
--- a/policy/modules/services/clamav.te
+++ b/policy/modules/services/clamav.te
@@ -330,5 +330,5 @@ optional_policy(`
')
ifdef(`distro_gentoo',`
- init_daemon_pid_file(clamd_var_run_t, dir, "clamav")
+ init_daemon_pid_file(clamd_runtime_t, dir, "clamav")
')
diff --git a/policy/modules/services/courier.te
b/policy/modules/services/courier.te
index dce1451b..5a4c7ea7 100644
--- a/policy/modules/services/courier.te
+++ b/policy/modules/services/courier.te
@@ -201,7 +201,7 @@ ifdef(`distro_gentoo',`
#
# Startup of courier-imapd creates /var/run/imapd.pid.lock and
imapd.lock (bug 534030)
- files_pid_filetrans(courier_tcpd_t, courier_var_run_t, file)
+ files_pid_filetrans(courier_tcpd_t, courier_runtime_t, file)
########################################
#
diff --git a/policy/modules/services/cron.fc b/policy/modules/services/cron.fc
index 6fdcdb78..ee64e81e 100644
--- a/policy/modules/services/cron.fc
+++ b/policy/modules/services/cron.fc
@@ -5,7 +5,7 @@
/usr/bin/anacron -- gen_context(system_u:object_r:anacron_exec_t,s0)
#/usr/bin/at -- gen_context(system_u:object_r:crontab_exec_t,s0)
-/usr/bin/atd -- gen_context(system_u:object_r:crond_exec_t,s0)
+#/usr/bin/atd -- gen_context(system_u:object_r:crond_exec_t,s0)
/usr/bin/cron(d)? -- gen_context(system_u:object_r:crond_exec_t,s0)
/usr/bin/fcron -- gen_context(system_u:object_r:crond_exec_t,s0)
/usr/bin/fcronsighup -- gen_context(system_u:object_r:crontab_exec_t,s0)
@@ -29,7 +29,6 @@
/var/log/rpmpkgs.* -- gen_context(system_u:object_r:cron_log_t,s0)
/run/anacron\.pid --
gen_context(system_u:object_r:crond_runtime_t,s0)
-/run/atd\.pid -- gen_context(system_u:object_r:crond_runtime_t,s0)
/run/cron(d)?\.pid --
gen_context(system_u:object_r:crond_runtime_t,s0)
/run/cron(d)?\.reboot --
gen_context(system_u:object_r:crond_runtime_t,s0)
/run/fcron\.fifo -s
gen_context(system_u:object_r:crond_runtime_t,s0)
@@ -37,7 +36,6 @@
/run/.*cron.* -- gen_context(system_u:object_r:crond_runtime_t,s0)
/var/spool/anacron(/.*)?
gen_context(system_u:object_r:system_cron_spool_t,s0)
-/var/spool/at(/.*)? gen_context(system_u:object_r:user_cron_spool_t,s0)
/var/spool/cron -d gen_context(system_u:object_r:cron_spool_t,s0)
#/var/spool/cron/root --
gen_context(system_u:object_r:sysadm_cron_spool_t,s0)
diff --git a/policy/modules/services/cron.rst b/policy/modules/services/cron.rst
index a35c26a4..773af37b 100644
--- a/policy/modules/services/cron.rst
+++ b/policy/modules/services/cron.rst
@@ -208,7 +208,7 @@ cron_var_lib_t
crond_tmp_t
is used for the temporary files created/managed by the cron daemon
-crond_var_run_t
+crond_runtime_t
is used for the variable runtime information of the cron daemon
POLICY
diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if
index 7337fcd3..6169143e 100644
--- a/policy/modules/services/dbus.if
+++ b/policy/modules/services/dbus.if
@@ -607,7 +607,7 @@ interface(`dbus_unconfined',`
########################################
## <summary>
-## Create resources in /run or /var/run with the system_dbusd_var_run_t
+## Create resources in /run or /var/run with the system_dbusd_runtime_t
## label. This method is deprecated in favor of the init_daemon_run_dir
## call.
## </summary>
@@ -633,7 +633,7 @@
interface(`dbus_generic_pid_filetrans_system_dbusd_var_run',`
########################################
## <summary>
-## Create directories with the system_dbusd_var_run_t label
+## Create directories with the system_dbusd_runtime_t label
## </summary>
## <param name="domain">
## <summary>
@@ -643,10 +643,10 @@
interface(`dbus_generic_pid_filetrans_system_dbusd_var_run',`
#
interface(`dbus_create_system_dbusd_var_run_dirs',`
gen_require(`
- type system_dbusd_var_run_t;
+ type system_dbusd_runtime_t;
')
- create_dirs_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t)
+ create_dirs_pattern($1, system_dbusd_runtime_t, system_dbusd_runtime_t)
')
diff --git a/policy/modules/services/fail2ban.te
b/policy/modules/services/fail2ban.te
index 50264730..067d5caf 100644
--- a/policy/modules/services/fail2ban.te
+++ b/policy/modules/services/fail2ban.te
@@ -163,9 +163,9 @@ ifdef(`distro_gentoo',`
files_dontaudit_write_usr_dirs(fail2ban_t)
# Fix bug 534256 - Startup fails without these
- allow fail2ban_client_t fail2ban_var_run_t:dir write;
+ allow fail2ban_client_t fail2ban_runtime_t:dir write;
- init_daemon_pid_file(fail2ban_var_run_t, dir, "fail2ban")
+ init_daemon_pid_file(fail2ban_runtime_t, dir, "fail2ban")
init_use_script_ptys(fail2ban_client_t)
')
diff --git a/policy/modules/services/ldap.te b/policy/modules/services/ldap.te
index 50d7769d..31b895d7 100644
--- a/policy/modules/services/ldap.te
+++ b/policy/modules/services/ldap.te
@@ -154,7 +154,7 @@ optional_policy(`
')
ifdef(`distro_gentoo',`
- init_daemon_pid_file(slapd_var_run_t, dir, "openldap")
+ init_daemon_pid_file(slapd_runtime_t, dir, "openldap")
########################################
#
diff --git a/policy/modules/services/munin.rst
b/policy/modules/services/munin.rst
index 220c75e1..207c2f19 100644
--- a/policy/modules/services/munin.rst
+++ b/policy/modules/services/munin.rst
@@ -71,7 +71,7 @@ munin_plugin_state_t
munin_var_lib_t
is used for the variable information used by munin
-munin_var_run_t
+munin_runtime_t
is used for the variable runtime state information of munin
POLICY
diff --git a/policy/modules/services/mysql.if b/policy/modules/services/mysql.if
index 82b5f1e2..bf5c0b70 100644
--- a/policy/modules/services/mysql.if
+++ b/policy/modules/services/mysql.if
@@ -449,10 +449,10 @@ interface(`mysql_admin',`
#
interface(`mysql_setattr_run_dirs',`
gen_require(`
- type mysqld_var_run_t;
+ type mysqld_runtime_t;
')
- setattr_dirs_pattern($1, mysqld_var_run_t, mysqld_var_run_t)
+ setattr_dirs_pattern($1, mysqld_runtime_t, mysqld_runtime_t)
')
#######################################
@@ -467,10 +467,10 @@ interface(`mysql_setattr_run_dirs',`
#
interface(`mysql_create_run_dirs',`
gen_require(`
- type mysqld_var_run_t;
+ type mysqld_runtime_t;
')
- create_dirs_pattern($1, mysqld_var_run_t, mysqld_var_run_t)
+ create_dirs_pattern($1, mysqld_runtime_t, mysqld_runtime_t)
')
#######################################
diff --git a/policy/modules/services/networkmanager.fc
b/policy/modules/services/networkmanager.fc
index d37b86de..e7c1b89e 100644
--- a/policy/modules/services/networkmanager.fc
+++ b/policy/modules/services/networkmanager.fc
@@ -47,4 +47,4 @@
/run/nm-dns-dnsmasq\.conf --
gen_context(system_u:object_r:NetworkManager_runtime_t,s0)
/run/wpa_supplicant(/.*)?
gen_context(system_u:object_r:NetworkManager_runtime_t,s0)
/run/wpa_supplicant-global -s
gen_context(system_u:object_r:NetworkManager_runtime_t,s0)
-/run/wpa_cli-.* --
gen_context(system_u:object_r:wpa_cli_var_run_t,s0)
+/run/wpa_cli-.* --
gen_context(system_u:object_r:wpa_cli_runtime_t,s0)
diff --git a/policy/modules/services/networkmanager.te
b/policy/modules/services/networkmanager.te
index 309e3363..e3af7618 100644
--- a/policy/modules/services/networkmanager.te
+++ b/policy/modules/services/networkmanager.te
@@ -38,8 +38,8 @@ type wpa_cli_exec_t;
init_system_domain(wpa_cli_t, wpa_cli_exec_t)
ifdef(`distro_gentoo',`
- type wpa_cli_var_run_t;
- files_pid_file(wpa_cli_var_run_t)
+ type wpa_cli_runtime_t alias wpa_cli_var_run_t;
+ files_pid_file(wpa_cli_runtime_t)
')
########################################
@@ -425,8 +425,8 @@ ifdef(`distro_gentoo',`
#
# wpa_cli_t policy
#
- manage_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t)
- files_pid_filetrans(wpa_cli_t, wpa_cli_var_run_t, file)
+ manage_files_pattern(wpa_cli_t, wpa_cli_runtime_t, wpa_cli_runtime_t)
+ files_pid_filetrans(wpa_cli_t, wpa_cli_runtime_t, file)
corecmd_exec_bin(wpa_cli_t)
corecmd_exec_shell(wpa_cli_t)
diff --git a/policy/modules/services/ntp.fc b/policy/modules/services/ntp.fc
index 623451cf..b16c5739 100644
--- a/policy/modules/services/ntp.fc
+++ b/policy/modules/services/ntp.fc
@@ -39,7 +39,7 @@
/var/log/ntp.* --
gen_context(system_u:object_r:ntpd_log_t,s0)
/var/log/ntpstats(/.*)?
gen_context(system_u:object_r:ntpd_log_t,s0)
/var/log/xntpd.* --
gen_context(system_u:object_r:ntpd_log_t,s0)
-/run/ntpd\.sock -s gen_context(system_u:object_r:ntpd_var_run_t,s0)
+/run/ntpd\.sock -s gen_context(system_u:object_r:ntpd_pid_t,s0)
ifdef(`distro_gentoo',`
/var/lib/openntpd/ntpd.drift --
gen_context(system_u:object_r:ntp_drift_t,s0)
diff --git a/policy/modules/system/authlogin.te
b/policy/modules/system/authlogin.te
index 2bf22f72..2b34a4f9 100644
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@@ -477,5 +477,5 @@ optional_policy(`
')
ifdef(`distro_gentoo',`
- init_daemon_pid_file(pam_var_run_t, dir, "sepermit")
+ init_daemon_pid_file(pam_runtime_t, dir, "sepermit")
')
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index fe9b8535..4d152ee1 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -1383,8 +1383,8 @@ ifdef(`distro_gentoo',`
read_files_pattern(initrc_t, init_script_readable, init_script_readable)
read_lnk_files_pattern(initrc_t, init_script_readable,
init_script_readable)
- manage_dirs_pattern(initrc_t, initrc_var_run_t, initrc_var_run_t)
- files_pid_filetrans(initrc_t, initrc_var_run_t, dir)
+ manage_dirs_pattern(initrc_t, initrc_runtime_t, initrc_runtime_t)
+ files_pid_filetrans(initrc_t, initrc_runtime_t, dir)
kernel_write_proc_files(initrc_t)
diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te
index 857c6f23..6b705bfe 100644
--- a/policy/modules/system/lvm.te
+++ b/policy/modules/system/lvm.te
@@ -401,7 +401,7 @@ ifdef(`distro_gentoo',`
# Bug 529430 comment 6
create_dirs_pattern(lvm_t, lvm_etc_t, lvm_etc_t)
# Bug 529430 comment 8
- manage_fifo_files_pattern(lvm_t, lvm_var_run_t, lvm_var_run_t)
+ manage_fifo_files_pattern(lvm_t, lvm_runtime_t, lvm_runtime_t)
# Bug 615300
init_read_script_pipes(lvm_t)
diff --git a/policy/modules/system/modutils.te
b/policy/modules/system/modutils.te
index df4193d6..33729a23 100644
--- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te
@@ -216,6 +216,6 @@ ifdef(`distro_gentoo',`
files_manage_kernel_modules(kmod_t)
# for /run/tmpfiles.d/kmod.conf
- tmpfiles_create_var_run_files(kmod_t)
- filetrans_add_pattern(kmod_t, tmpfiles_var_run_t, kmod_tmpfiles_conf_t,
file)
+ tmpfiles_create_runtime_files(kmod_t)
+ filetrans_add_pattern(kmod_t, tmpfiles_runtime_t, kmod_tmpfiles_conf_t,
file)
')
diff --git a/policy/modules/system/sysnetwork.fc
b/policy/modules/system/sysnetwork.fc
index 69b6ce88..1a8f7281 100644
--- a/policy/modules/system/sysnetwork.fc
+++ b/policy/modules/system/sysnetwork.fc
@@ -93,6 +93,6 @@ ifdef(`distro_debian',`
ifdef(`distro_gentoo',`
/usr/lib/dhcpcd/dhcpcd-run-hooks --
gen_context(system_u:object_r:dhcpc_script_exec_t,s0)
-/run/dhcpcd\.sock -s
gen_context(system_u:object_r:dhcpc_var_run_t,s0)
-/run/dhcpcd\.unpriv\.sock -s
gen_context(system_u:object_r:dhcpc_var_run_t,s0)
+/run/dhcpcd\.sock -s
gen_context(system_u:object_r:dhcpc_runtime_t,s0)
+/run/dhcpcd\.unpriv\.sock -s
gen_context(system_u:object_r:dhcpc_runtime_t,s0)
')
diff --git a/policy/modules/system/sysnetwork.te
b/policy/modules/system/sysnetwork.te
index bacb3794..bb54a544 100644
--- a/policy/modules/system/sysnetwork.te
+++ b/policy/modules/system/sysnetwork.te
@@ -434,14 +434,14 @@ ifdef(`distro_gentoo',`
allow dhcpc_t self:netlink_socket client_stream_socket_perms;
# Allow dhcpcd to set its control sockets
- allow dhcpc_t dhcpc_var_run_t:sock_file manage_sock_file_perms;
+ allow dhcpc_t dhcpc_runtime_t:sock_file manage_sock_file_perms;
# Allow dhcpc to set hostname (/proc/sys/kernel/hostname)
allow dhcpc_t self:capability sys_admin;
kernel_rw_kernel_sysctl(dhcpc_t)
# Fixes bug 468878
- files_pid_filetrans(dhcpc_t, dhcpc_var_run_t, sock_file)
+ files_pid_filetrans(dhcpc_t, dhcpc_runtime_t, sock_file)
allow dhcpc_t self:unix_stream_socket { create_stream_socket_perms
connectto };
optional_policy(`
@@ -479,9 +479,9 @@ ifdef(`distro_gentoo',`
manage_files_pattern(dhcpc_script_t, dhcpc_script_tmp_t,
dhcpc_script_tmp_t)
files_tmp_filetrans(dhcpc_script_t, dhcpc_script_tmp_t, { file dir })
- manage_files_pattern(dhcpc_script_t, dhcpc_var_run_t, dhcpc_var_run_t)
- create_dirs_pattern(dhcpc_script_t, dhcpc_var_run_t, dhcpc_var_run_t)
- files_pid_filetrans(dhcpc_script_t, dhcpc_var_run_t, { file dir })
+ manage_files_pattern(dhcpc_script_t, dhcpc_runtime_t, dhcpc_runtime_t)
+ create_dirs_pattern(dhcpc_script_t, dhcpc_runtime_t, dhcpc_runtime_t)
+ files_pid_filetrans(dhcpc_script_t, dhcpc_runtime_t, { file dir })
kernel_read_network_state(dhcpc_script_t)
kernel_read_system_state(dhcpc_script_t)
diff --git a/policy/modules/system/tmpfiles.fc
b/policy/modules/system/tmpfiles.fc
index 16d821a8..5a13949c 100644
--- a/policy/modules/system/tmpfiles.fc
+++ b/policy/modules/system/tmpfiles.fc
@@ -1,7 +1,7 @@
ifndef(`init_systemd',`
/etc/tmpfiles.d(/.*)?
gen_context(system_u:object_r:tmpfiles_conf_t,s0)
-/run/tmpfiles.d(/.*)?
gen_context(system_u:object_r:tmpfiles_var_run_t,s0)
+/run/tmpfiles.d(/.*)?
gen_context(system_u:object_r:tmpfiles_runtime_t,s0)
')
/usr/bin/tmpfiles --
gen_context(system_u:object_r:tmpfiles_exec_t,s0)
diff --git a/policy/modules/system/tmpfiles.if
b/policy/modules/system/tmpfiles.if
index 09897fc0..361dc8c4 100644
--- a/policy/modules/system/tmpfiles.if
+++ b/policy/modules/system/tmpfiles.if
@@ -10,14 +10,14 @@
## </summary>
## </param>
#
-interface(`tmpfiles_read_var_run',`
+interface(`tmpfiles_read_runtime',`
gen_require(`
- type tmpfiles_var_run_t;
+ type tmpfiles_runtime_t;
')
files_search_pids($1)
- allow $1 tmpfiles_var_run_t:dir list_dir_perms;
- allow $1 tmpfiles_var_run_t:file read_file_perms;
+ allow $1 tmpfiles_runtime_t:dir list_dir_perms;
+ allow $1 tmpfiles_runtime_t:file read_file_perms;
')
########################################
@@ -30,14 +30,14 @@ interface(`tmpfiles_read_var_run',`
## </summary>
## </param>
#
-interface(`tmpfiles_create_var_run_files',`
+interface(`tmpfiles_create_runtime_files',`
gen_require(`
- type tmpfiles_var_run_t;
+ type tmpfiles_runtime_t;
')
- create_files_pattern($1, tmpfiles_var_run_t, tmpfiles_var_run_t)
+ create_files_pattern($1, tmpfiles_runtime_t, tmpfiles_runtime_t)
- tmpfiles_read_var_run($1)
+ tmpfiles_read_runtime($1)
')
########################################
@@ -50,14 +50,14 @@ interface(`tmpfiles_create_var_run_files',`
## </summary>
## </param>
#
-interface(`tmpfiles_write_var_run_files',`
+interface(`tmpfiles_write_runtime_files',`
gen_require(`
- type tmpfiles_var_run_t;
+ type tmpfiles_runtime_t;
')
- write_files_pattern($1, tmpfiles_var_run_t, tmpfiles_var_run_t)
+ write_files_pattern($1, tmpfiles_runtime_t, tmpfiles_runtime_t)
- tmpfiles_read_var_run($1)
+ tmpfiles_read_runtime($1)
')
########################################
@@ -70,14 +70,14 @@ interface(`tmpfiles_write_var_run_files',`
## </summary>
## </param>
#
-interface(`tmpfiles_manage_var_run_files',`
+interface(`tmpfiles_manage_runtime_files',`
gen_require(`
- type tmpfiles_var_run_t;
+ type tmpfiles_runtime_t;
')
- tmpfiles_read_var_run($1)
+ tmpfiles_read_runtime($1)
- manage_files_pattern($1, tmpfiles_var_run_t, tmpfiles_var_run_t)
+ manage_files_pattern($1, tmpfiles_runtime_t, tmpfiles_runtime_t)
')
########################################
diff --git a/policy/modules/system/tmpfiles.rst
b/policy/modules/system/tmpfiles.rst
index 748032b4..a445072a 100644
--- a/policy/modules/system/tmpfiles.rst
+++ b/policy/modules/system/tmpfiles.rst
@@ -49,7 +49,7 @@ tmpfiles_conf_t
tmpfiles_exec_t
is used as entrypoint for the tmpfiles application
-tmpfiles_var_run_t
+tmpfiles_runtime_t
is used as the variable run-time data used by the tmpfiles application
POLICY
diff --git a/policy/modules/system/tmpfiles.te
b/policy/modules/system/tmpfiles.te
index 9063ca3e..57be1edc 100644
--- a/policy/modules/system/tmpfiles.te
+++ b/policy/modules/system/tmpfiles.te
@@ -23,8 +23,8 @@ init_daemon_domain(tmpfiles_t, tmpfiles_exec_t)
type tmpfiles_conf_t;
files_config_file(tmpfiles_conf_t)
-type tmpfiles_var_run_t;
-files_pid_file(tmpfiles_var_run_t)
+type tmpfiles_runtime_t alias tmpfiles_var_run_t;
+files_pid_file(tmpfiles_runtime_t)
########################################
@@ -42,8 +42,8 @@ allow tmpfiles_t tmpfiles_exec_t:file execute_no_trans;
list_dirs_pattern(tmpfiles_t, tmpfiles_conf_t, tmpfiles_conf_t)
read_files_pattern(tmpfiles_t, tmpfiles_conf_t, tmpfiles_conf_t)
-manage_files_pattern(tmpfiles_t, tmpfiles_var_run_t, tmpfiles_var_run_t)
-manage_dirs_pattern(tmpfiles_t, tmpfiles_var_run_t, tmpfiles_var_run_t)
+manage_files_pattern(tmpfiles_t, tmpfiles_runtime_t, tmpfiles_runtime_t)
+manage_dirs_pattern(tmpfiles_t, tmpfiles_runtime_t, tmpfiles_runtime_t)
corecmd_exec_bin(tmpfiles_t)
corecmd_exec_shell(tmpfiles_t)
