commit: 93685fc8ed051425c610d8f1f3ab76d9fefbb956
Author: Marc Schiffbauer <mschiff <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 24 16:39:08 2025 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Jul 15 08:04:55 2025 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=93685fc8
dnsmasq: make dnsmasq work with systemd-resolved
Signed-off-by: Marc Schiffbauer <mschiff <AT> gentoo.org>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/services/dnsmasq.te | 6 ++++++
policy/modules/system/systemd.if | 18 ++++++++++++++++++
2 files changed, 24 insertions(+)
diff --git a/policy/modules/services/dnsmasq.te
b/policy/modules/services/dnsmasq.te
index 270f2a21a..ff66c5763 100644
--- a/policy/modules/services/dnsmasq.te
+++ b/policy/modules/services/dnsmasq.te
@@ -130,6 +130,12 @@ optional_policy(`
seutil_sigchld_newrole(dnsmasq_t)
')
+optional_policy(`
+ systemd_read_resolved_runtime(dnsmasq_t)
+ systemd_list_resolved_runtime(dnsmasq_t)
+ systemd_watch_resolved_runtime_dirs(dnsmasq_t)
+')
+
optional_policy(`
tftp_read_content(dnsmasq_t)
')
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index e7419cc30..7e58453df 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -2331,6 +2331,24 @@ interface(`systemd_read_networkd_runtime',`
read_files_pattern($1, systemd_networkd_runtime_t,
systemd_networkd_runtime_t)
')
+#######################################
+## <summary>
+## Watch directories under /run/systemd/resolve
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain permitted the access
+## </summary>
+## </param>
+#
+interface(`systemd_watch_resolved_runtime_dirs',`
+ gen_require(`
+ type systemd_resolved_runtime_t;
+ ')
+
+ allow $1 systemd_resolved_runtime_t:dir watch;
+')
+
#######################################
## <summary>
## Connect to systemd-nsresourced over
