commit: c5f642792afda4f820b416e1f0e8f82b683b52bf
Author: Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Mon May 6 20:03:10 2024 +0000
Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Tue May 14 17:41:36 2024 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=c5f64279
userdom: allow users to read user home dir symlinks
This is to support user home directories primarily living in another
directory with a symlink in /home that points to it.
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>
policy/modules/system/userdomain.if | 3 +++
1 file changed, 3 insertions(+)
diff --git a/policy/modules/system/userdomain.if
b/policy/modules/system/userdomain.if
index 401c5e6f7..1d98629c6 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -318,6 +318,7 @@ interface(`userdom_ro_home_role',`
# read-only home directory
allow $2 user_home_dir_t:dir list_dir_perms;
+ allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
allow $2 user_home_t:dir list_dir_perms;
allow $2 user_home_t:file entrypoint;
read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
@@ -394,6 +395,8 @@ interface(`userdom_manage_home_role',`
type_member $2 user_home_dir_t:dir user_home_dir_t;
+ allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
+
# full control of the home directory
allow $2 user_home_t:file entrypoint;
manage_dirs_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
