commit: 968134591ae36b6064488b8ed9d7082aad03101b
Author: Chris PeBenito <cpebenito <AT> tresys <DOT> com>
AuthorDate: Tue Oct 20 15:29:11 2015 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Oct 26 03:35:39 2015 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=96813459
Add systemd access vectors.
policy/flask/access_vectors | 21 +++++++++++++++++++++
policy/flask/security_classes | 2 ++
2 files changed, 23 insertions(+)
diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
index 056cdd7..3fe2bb9 100644
--- a/policy/flask/access_vectors
+++ b/policy/flask/access_vectors
@@ -393,6 +393,17 @@ class system
syslog_mod
syslog_console
module_request
+
+ # these are overloaded userspace
+ # permissions from systemd
+ halt
+ reboot
+ status
+ start
+ stop
+ enable
+ disable
+ reload
}
#
@@ -910,3 +921,13 @@ inherits database
implement
execute
}
+
+class service
+{
+ start
+ stop
+ status
+ reload
+ enable
+ disable
+}
diff --git a/policy/flask/security_classes b/policy/flask/security_classes
index 8bc5d4e..8b6f1ed 100644
--- a/policy/flask/security_classes
+++ b/policy/flask/security_classes
@@ -145,4 +145,6 @@ class db_view # userspace
class db_sequence # userspace
class db_language # userspace
+class service # userspace
+
# FLASK
