[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/

[Jason Zaman]

commit:     5135e685790073660abb1e0ef52816fb542f75a9
Author:     Dave Sugar <dsugar100 <AT> gmail <DOT> com>
AuthorDate: Fri Aug 26 18:02:45 2022 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Sep  3 19:07:50 2022 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=5135e685

firewalld: write tmpfs files

node=localhost type=AVC msg=audit(1661536245.787:9531): avc:  denied  { write } 
for  pid=1008 comm="firewalld" 
path=2F6D656D66643A6C6962666669202864656C6574656429 dev="tmpfs" ino=2564 
scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 
tclass=file permissive=1
node=localhost type=AVC msg=audit(1661536245.788:9532): avc:  denied  { map } 
for  pid=1008 comm="firewalld" 
path=2F6D656D66643A6C6962666669202864656C6574656429 dev="tmpfs" ino=2564 
scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 
tclass=file permissive=1
node=localhost type=AVC msg=audit(1661536245.788:9532): avc:  denied  { read 
execute } for  pid=1008 comm="firewalld" 
path=2F6D656D66643A6C6962666669202864656C6574656429 dev="tmpfs" ino=2564 
scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 
tclass=file permissive=1

Signed-off-by: Dave Sugar <dsugar100 <AT> gmail.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/services/firewalld.te | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/policy/modules/services/firewalld.te 
b/policy/modules/services/firewalld.te
index a32e4b93..32e16898 100644
--- a/policy/modules/services/firewalld.te
+++ b/policy/modules/services/firewalld.te
@@ -24,6 +24,9 @@ logging_log_file(firewalld_var_log_t)
 type firewalld_tmp_t;
 files_tmp_file(firewalld_tmp_t)
 
+type firewalld_tmpfs_t;
+files_tmpfs_file(firewalld_tmpfs_t)
+
 ########################################
 #
 # Local policy
@@ -54,6 +57,11 @@ manage_dirs_pattern(firewalld_t, firewalld_runtime_t, 
firewalld_runtime_t)
 manage_files_pattern(firewalld_t, firewalld_runtime_t, firewalld_runtime_t)
 files_runtime_filetrans(firewalld_t, firewalld_runtime_t, { dir file })
 
+manage_dirs_pattern(firewalld_t, firewalld_tmpfs_t, firewalld_tmpfs_t)
+manage_files_pattern(firewalld_t, firewalld_tmpfs_t, firewalld_tmpfs_t)
+mmap_read_files_pattern(firewalld_t, firewalld_tmpfs_t, firewalld_tmpfs_t)
+fs_tmpfs_filetrans(firewalld_t, firewalld_tmpfs_t, { dir file })
+
 kernel_read_crypto_sysctls(firewalld_t)
 kernel_read_network_state(firewalld_t)
 kernel_read_system_state(firewalld_t)