commit: 71328f3f02d4765b904f1a2a6c9fe140cb116182 Author: Kenton Groombridge <me <AT> concord <DOT> sh> AuthorDate: Mon Mar 6 18:37:02 2023 +0000 Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org> CommitDate: Fri Mar 31 17:11:32 2023 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=71328f3f
files, systemd: allow systemd-tmpfiles to relabel config file symlinks Signed-off-by: Kenton Groombridge <me <AT> concord.sh> Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org> policy/modules/kernel/files.if | 19 +++++++++++++++++++ policy/modules/system/systemd.te | 3 ++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index a895f3734..6fe764a7a 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -1713,6 +1713,25 @@ interface(`files_dontaudit_relabel_config_files',` dontaudit $1 configfile:file relabel_file_perms; ') +####################################### +## <summary> +## Relabel configuration symlinks. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## +# +interface(`files_relabel_config_symlinks',` + gen_require(` + attribute configfile; + ') + + relabel_lnk_files_pattern($1, configfile, configfile) +') + ######################################## ## <summary> ## Mount a filesystem on all mount points. diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index 778052cde..59a3fcfc5 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -1704,8 +1704,9 @@ files_manage_all_locks(systemd_tmpfiles_t) files_purge_tmp(systemd_tmpfiles_t) files_read_etc_files(systemd_tmpfiles_t) files_read_etc_runtime_files(systemd_tmpfiles_t) -files_relabel_config_files(systemd_tmpfiles_t) files_relabel_config_dirs(systemd_tmpfiles_t) +files_relabel_config_files(systemd_tmpfiles_t) +files_relabel_config_symlinks(systemd_tmpfiles_t) files_relabel_all_locks(systemd_tmpfiles_t) files_relabel_all_runtime_dirs(systemd_tmpfiles_t) files_relabel_all_tmp_dirs(systemd_tmpfiles_t)