[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/apps/

[Jason Zaman]

commit:     1d91ca83f936e09cef6385ffd7b6a9ab51c9adb9
Author:     Pat Riehecky <riehecky <AT> fnal <DOT> gov>
AuthorDate: Wed Feb 26 21:26:02 2025 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Mar  8 23:26:43 2025 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=1d91ca83

Permit init_t to start a detached screen session

Signed-off-by: Pat Riehecky <riehecky <AT> fnal.gov>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/apps/screen.if | 17 +++++++++++++++++
 policy/modules/system/init.te |  4 ++++
 2 files changed, 21 insertions(+)

diff --git a/policy/modules/apps/screen.if b/policy/modules/apps/screen.if
index fadb0df94..464e4e9ce 100644
--- a/policy/modules/apps/screen.if
+++ b/policy/modules/apps/screen.if
@@ -138,3 +138,20 @@ interface(`screen_dontaudit_getattr_sock_file',`
 
        dontaudit $1 screen_runtime_t:sock_file getattr;
 ')
+
+########################################
+## <summary>
+##      Permit running screen
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+interface(`screen_exec',`
+       gen_require(`
+               type screen_exec_t;
+       ')
+
+       allow $1 screen_exec_t:file mmap_exec_file_perms;
+')

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index b3d1a4698..1320f7aae 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -72,6 +72,10 @@ optional_policy(`
        kubernetes_mountpoint(init_t)
 ')
 
+optional_policy(`
+       screen_exec(init_t)
+')
+
 #
 # init_runtime_t is the type for /var/run/shutdown.pid and /var/run/systemd.
 #