[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/

[Jason Zaman]

commit:     f7e5d1a892569f1f9adb0df63eb3965340763a5e
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Tue Jan 11 19:59:59 2022 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan 30 01:15:06 2022 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=f7e5d1a8

systemd: allow systemd user managers to execute user bin files

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/system/systemd.if | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index 975623f5..4906767a 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -126,6 +126,8 @@ template(`systemd_role_template',`
        dbus_spec_session_bus_client($1, $1_systemd_t)
        dbus_connect_spec_session_bus($1, $1_systemd_t)
 
+       userdom_exec_user_bin_files($1_systemd_t)
+
        # userdomain rules
        allow $3 $1_systemd_t:process signal;
        allow $3 $1_systemd_t:unix_stream_socket rw_stream_socket_perms;