commit: f7562c68653aa05322e30db0faa577080cb1e6bb
Author: Russell Coker <russell <AT> coker <DOT> com <DOT> au>
AuthorDate: Tue Jul 22 15:13:26 2025 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Sep 2 21:59:08 2025 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=f7562c68
acpi (#979)
* Some small fixes for acpi
Label acpi_fakekeyd
Allow acpid to talk to systemd-logind
Allow rw to input devices
Signed-off-by: Russell Coker <russell <AT> coker.com.au>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/services/acpi.fc | 1 +
policy/modules/services/acpi.te | 7 ++++++-
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/policy/modules/services/acpi.fc b/policy/modules/services/acpi.fc
index dee6897f7..ba9fb481c 100644
--- a/policy/modules/services/acpi.fc
+++ b/policy/modules/services/acpi.fc
@@ -8,6 +8,7 @@
/usr/lib/systemd/system/apmd.*\.service --
gen_context(system_u:object_r:acpid_unit_t,s0)
/usr/sbin/acpid -- gen_context(system_u:object_r:acpid_exec_t,s0)
+/usr/sbin/acpi_fakekeyd --
gen_context(system_u:object_r:acpid_exec_t,s0)
/usr/sbin/apmd -- gen_context(system_u:object_r:acpid_exec_t,s0)
/usr/sbin/powersaved -- gen_context(system_u:object_r:acpid_exec_t,s0)
diff --git a/policy/modules/services/acpi.te b/policy/modules/services/acpi.te
index 106bdee6b..9e44d24dd 100644
--- a/policy/modules/services/acpi.te
+++ b/policy/modules/services/acpi.te
@@ -64,7 +64,8 @@ logging_send_syslog_msg(acpi_t)
allow acpid_t self:capability { kill mknod sys_admin sys_nice sys_time };
dontaudit acpid_t self:capability { dac_override dac_read_search setuid
sys_ptrace sys_tty_config };
-allow acpid_t self:process { getsession signal_perms };
+allow acpid_t self:process { getsession signal_perms getsched };
+
allow acpid_t self:fifo_file rw_fifo_file_perms;
allow acpid_t self:netlink_socket create_socket_perms;
allow acpid_t self:netlink_generic_socket create_socket_perms;
@@ -101,6 +102,7 @@ dev_read_mouse(acpid_t)
dev_read_realtime_clock(acpid_t)
dev_read_urand(acpid_t)
dev_rw_acpi_bios(acpid_t)
+dev_rw_input_dev(acpid_t)
dev_rw_sysfs(acpid_t)
dev_watch_dev_dirs(acpid_t)
dev_dontaudit_getattr_all_chr_files(acpid_t)
@@ -136,6 +138,7 @@ domain_dontaudit_list_all_domains_state(acpid_t)
auth_use_nsswitch(acpid_t)
init_domtrans_script(acpid_t)
+init_read_utmp(acpid_t)
init_telinit(acpid_t)
libs_exec_ld_so(acpid_t)
@@ -218,6 +221,8 @@ optional_policy(`
optional_policy(`
init_list_unit_dirs(acpid_t)
+ systemd_dbus_chat_logind(acpid_t)
+ systemd_read_logind_sessions_files(acpid_t)
systemd_start_power_units(acpid_t)
systemd_status_power_units(acpid_t)
')
