[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/

[Kenton Groombridge]

commit:     b08912707a9b728f5c35760cf1b2464594cdaad1
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Mon Mar  6 15:25:29 2023 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Fri Mar 31 17:11:32 2023 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b0891270

init, systemd: allow init to create userdb runtime symlinks

At boot, systemd-init will create symlinks in /run/systemd/userdb. This
fixes these AVCs:

avc:  denied  { create } for  pid=1 comm="systemd" 
name="io.systemd.NameServiceSwitch" scontext=system_u:system_r:init_t:s0 
tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=lnk_file 
permissive=0
avc:  denied  { create } for  pid=1 comm="systemd" name="io.systemd.DropIn" 
scontext=system_u:system_r:init_t:s0 
tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=lnk_file 
permissive=0

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/system/init.te    |  1 +
 policy/modules/system/systemd.if | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 562b45c59..a2b0693b6 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -532,6 +532,7 @@ ifdef(`init_systemd',`
        systemd_relabelto_tmpfiles_conf_files(init_t)
        systemd_manage_userdb_runtime_sock_files(init_t)
        systemd_manage_userdb_runtime_dirs(init_t)
+       systemd_manage_userdb_runtime_symlinks(init_t)
        systemd_filetrans_userdb_runtime_dirs(init_t)
        systemd_relabelto_journal_dirs(init_t)
        systemd_relabelto_journal_files(init_t)

diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index 1dd302851..a903282f0 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -1402,6 +1402,24 @@ interface(`systemd_read_userdb_runtime_files', `
        read_files_pattern($1, systemd_userdbd_runtime_t, 
systemd_userdbd_runtime_t)
 ')
 
+########################################
+## <summary>
+##  Manage symbolic links under /run/systemd/userdb.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`systemd_manage_userdb_runtime_symlinks', `
+       gen_require(`
+               type systemd_userdbd_runtime_t;
+       ')
+
+       manage_lnk_files_pattern($1, systemd_userdbd_runtime_t, 
systemd_userdbd_runtime_t)
+')
+
 ########################################
 ## <summary>
 ##  Manage socket files under /run/systemd/userdb .