commit: ba28793f2d89e4ed0f0bd0a24762b046a3afd643
Author: Yi Zhao <yi.zhao <AT> windriver <DOT> com>
AuthorDate: Sun Aug 11 12:06:45 2024 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Sep 21 22:28:29 2024 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=ba28793f
systemd: allow systemd-networkd to manage sock files under /run/systemd/netif
Fixes:
avc: denied { create } for pid=344 comm="systemd-network"
name="io.systemd.Network" scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:systemd_networkd_runtime_t tclass=sock_file
permissive=1
Signed-off-by: Yi Zhao <yi.zhao <AT> windriver.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/system/systemd.te | 1 +
1 file changed, 1 insertion(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 1ac08e7d2..5725d7c76 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1270,6 +1270,7 @@ allow systemd_networkd_t self:unix_dgram_socket
create_socket_perms;
manage_dirs_pattern(systemd_networkd_t, systemd_networkd_runtime_t,
systemd_networkd_runtime_t)
manage_files_pattern(systemd_networkd_t, systemd_networkd_runtime_t,
systemd_networkd_runtime_t)
manage_lnk_files_pattern(systemd_networkd_t, systemd_networkd_runtime_t,
systemd_networkd_runtime_t)
+manage_sock_files_pattern(systemd_networkd_t, systemd_networkd_runtime_t,
systemd_networkd_runtime_t)
init_var_lib_filetrans(systemd_networkd_t, systemd_networkd_var_lib_t, dir)
manage_dirs_pattern(systemd_networkd_t, systemd_networkd_var_lib_t,
systemd_networkd_var_lib_t)
