commit: f1666469b87a81d52a5a15aec0a53771b2b7e486
Author: Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Mon Jan 17 21:09:10 2022 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan 30 01:15:06 2022 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=f1666469
systemd: add supporting interfaces for user daemons
Add an interface to allow systemd user daemons to use systemd notify and
an interface to write to the systemd user runtime named socket.
Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/system/systemd.if | 48 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 48 insertions(+)
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index db98053a..e5214124 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -257,6 +257,35 @@ interface(`systemd_user_unix_stream_activated_socket',`
systemd_user_activated_sock_file($2)
')
+######################################
+## <summary>
+## Allow the target domain the permissions necessary
+## to use systemd notify when started by the specified
+## systemd user instance.
+## </summary>
+## <param name="prefix">
+## <summary>
+## Prefix for the user domain.
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain to be allowed systemd notify permissions.
+## </summary>
+## </param>
+#
+template(`systemd_user_send_systemd_notify',`
+ gen_require(`
+ type $1_systemd_t;
+ type systemd_user_runtime_notify_t;
+ ')
+
+ systemd_search_user_runtime($2)
+ allow $2 systemd_user_runtime_notify_t:sock_file rw_sock_file_perms;
+
+ allow $2 $1_systemd_t:unix_dgram_socket sendto;
+')
+
######################################
## <summary>
## Allow the target domain to be monitored and have its output
@@ -596,6 +625,25 @@ interface(`systemd_read_user_runtime_lnk_files',`
read_lnk_files_pattern($1, systemd_user_runtime_t,
systemd_user_runtime_t)
')
+######################################
+## <summary>
+## Allow the specified domain to write to
+## the systemd user runtime named socket.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`systemd_write_user_runtime_socket',`
+ gen_require(`
+ type systemd_user_runtime_t;
+ ')
+
+ allow $1 systemd_user_runtime_t:sock_file write;
+')
+
######################################
## <summary>
## Allow the specified domain to read system-wide systemd
