blob: 5ac5a19f5aed2068b5800bc9301232908428f1ee (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
From 7021844f20c5d5c885edf87abf8ce3329bcc5836 Mon Sep 17 00:00:00 2001
From: Wenzong Fan <wenzong.fan@windriver.com>
Date: Mon, 23 Jan 2017 08:42:44 +0000
Subject: [PATCH] policy/modules/system/systemd: make systemd-logind domain MLS
trusted for reading from files up to its clearance.
Fixes:
avc: denied { search } for pid=184 comm="systemd-logind"
name="journal" dev="tmpfs" ino=10949
scontext=system_u:system_r:systemd_logind_t:s0-s15:c0.c1023
tcontext=system_u:object_r:syslogd_runtime_t:s15:c0.c1023 tclass=dir
permissive=1
avc: denied { watch } for pid=184 comm="systemd-logind"
path="/run/utmp" dev="tmpfs" ino=12725
scontext=system_u:system_r:systemd_logind_t:s0-s15:c0.c1023
tcontext=system_u:object_r:initrc_runtime_t:s0 tclass=file permissive=1
Upstream-Status: Inappropriate [embedded specific]
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
policy/modules/system/systemd.te | 2 ++
1 file changed, 2 insertions(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index c50a2ba64..a7390b1cd 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -693,6 +693,8 @@ userdom_relabelto_user_runtime_dirs(systemd_logind_t)
userdom_setattr_user_ttys(systemd_logind_t)
userdom_use_user_ttys(systemd_logind_t)
+mls_file_read_to_clearance(systemd_logind_t)
+
# Needed to work around patch not yet merged into the systemd-logind supported on RHEL 7.x
# The change in systemd by Nicolas Iooss on 02-Feb-2016 with hash 4b51966cf6c06250036e428608da92f8640beb96
# should fix the problem where user directories in /run/user/$UID/ are not getting the proper context
--
2.17.1
|
