[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/, policy/modules/system/

[Kenton Groombridge]

commit:     71328f3f02d4765b904f1a2a6c9fe140cb116182
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Mon Mar  6 18:37:02 2023 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Fri Mar 31 17:11:32 2023 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=71328f3f

files, systemd: allow systemd-tmpfiles to relabel config file symlinks

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/kernel/files.if   | 19 +++++++++++++++++++
 policy/modules/system/systemd.te |  3 ++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index a895f3734..6fe764a7a 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -1713,6 +1713,25 @@ interface(`files_dontaudit_relabel_config_files',`
        dontaudit $1 configfile:file relabel_file_perms;
 ')
 
+#######################################
+## <summary>
+##     Relabel configuration symlinks.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+##
+#
+interface(`files_relabel_config_symlinks',`
+       gen_require(`
+               attribute configfile;
+       ')
+
+       relabel_lnk_files_pattern($1, configfile, configfile)
+')
+
 ########################################
 ## <summary>
 ##     Mount a filesystem on all mount points.

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 778052cde..59a3fcfc5 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1704,8 +1704,9 @@ files_manage_all_locks(systemd_tmpfiles_t)
 files_purge_tmp(systemd_tmpfiles_t)
 files_read_etc_files(systemd_tmpfiles_t)
 files_read_etc_runtime_files(systemd_tmpfiles_t)
-files_relabel_config_files(systemd_tmpfiles_t)
 files_relabel_config_dirs(systemd_tmpfiles_t)
+files_relabel_config_files(systemd_tmpfiles_t)
+files_relabel_config_symlinks(systemd_tmpfiles_t)
 files_relabel_all_locks(systemd_tmpfiles_t)
 files_relabel_all_runtime_dirs(systemd_tmpfiles_t)
 files_relabel_all_tmp_dirs(systemd_tmpfiles_t)