commit: f6088138b8acb7213d368f6acc481c7b417d9cf6
Author: Krzysztof Nowicki <krissn <AT> op <DOT> pl>
AuthorDate: Tue Aug 11 12:53:18 2020 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Feb 15 19:49:24 2021 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=f6088138
Allow execution of shell-scripted systemd generators
While systemd recommends to use native binaries as generators due to
performance reasons, there is nothing that really prevents from them
being shell scripts.
This is Gentoo-specific as the affected generator is provided by
the distribution, not by upstream systemd.
Signed-off-by: Krzysztof Nowicki <krissn <AT> op.pl>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/system/systemd.te | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 8ec415d0..5d34e6d2 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -443,6 +443,10 @@ systemd_log_parse_environment(systemd_generator_t)
term_use_unallocated_ttys(systemd_generator_t)
+ifdef(`distro_gentoo',`
+ corecmd_shell_entry_type(systemd_generator_t)
+')
+
optional_policy(`
fstools_exec(systemd_generator_t)
')
