commit: f6088138b8acb7213d368f6acc481c7b417d9cf6 Author: Krzysztof Nowicki <krissn <AT> op <DOT> pl> AuthorDate: Tue Aug 11 12:53:18 2020 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Mon Feb 15 19:49:24 2021 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=f6088138
Allow execution of shell-scripted systemd generators While systemd recommends to use native binaries as generators due to performance reasons, there is nothing that really prevents from them being shell scripts. This is Gentoo-specific as the affected generator is provided by the distribution, not by upstream systemd. Signed-off-by: Krzysztof Nowicki <krissn <AT> op.pl> Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> policy/modules/system/systemd.te | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index 8ec415d0..5d34e6d2 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -443,6 +443,10 @@ systemd_log_parse_environment(systemd_generator_t) term_use_unallocated_ttys(systemd_generator_t) +ifdef(`distro_gentoo',` + corecmd_shell_entry_type(systemd_generator_t) +') + optional_policy(` fstools_exec(systemd_generator_t) ')