commit: e7f3b34929de4d35cdce3344b6b0bdf988de5b56
Author: Yi Zhao <yi.zhao <AT> windriver <DOT> com>
AuthorDate: Sun Aug 11 12:00:44 2024 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Sep 21 22:28:29 2024 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=e7f3b349
systemd: set context to systemd_networkd_var_lib_t for /var/lib/systemd/network
Fixes:
avc: denied { read } for pid=344 comm="systemd-network"
path="/var/lib/systemd/network" dev="vda" ino=30708
scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:init_var_lib_t tclass=dir permissive=1
avc: denied { write } for pid=344 comm="systemd-network"
name="network" dev="vda" ino=30708
scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:init_var_lib_t tclass=dir permissive=1
avc: denied { getattr } for pid=344 comm="systemd-network"
path="/var/lib/systemd/network" dev="vda" ino=30708
scontext=system_u:system_r:systemd_networkd_t
tcontext=system_u:object_r:init_var_lib_t tclass=dir permissive=1
Signed-off-by: Yi Zhao <yi.zhao <AT> windriver.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/system/systemd.fc | 1 +
policy/modules/system/systemd.te | 7 +++++++
2 files changed, 8 insertions(+)
diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
index fd785c14e..dc41e9971 100644
--- a/policy/modules/system/systemd.fc
+++ b/policy/modules/system/systemd.fc
@@ -89,6 +89,7 @@ HOME_DIR/\.local/share/systemd(/.*)?
gen_context(system_u:object_r:systemd_data
/var/lib/systemd/coredump(/.*)?
gen_context(system_u:object_r:systemd_coredump_var_lib_t,s0)
/var/lib/systemd/home(/.*)?
gen_context(system_u:object_r:systemd_homed_var_lib_t,s0)
/var/lib/systemd/linger(/.*)?
gen_context(system_u:object_r:systemd_logind_var_lib_t,s0)
+/var/lib/systemd/network(/.*)?
gen_context(system_u:object_r:systemd_networkd_var_lib_t,s0)
/var/lib/systemd/pstore(/.*)?
gen_context(system_u:object_r:systemd_pstore_var_lib_t,s0)
/var/lib/systemd/rfkill(/.*)?
gen_context(system_u:object_r:systemd_rfkill_var_lib_t,s0)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index ff47e69f9..1ac08e7d2 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -216,6 +216,9 @@ init_mountpoint(systemd_networkd_runtime_t)
type systemd_networkd_unit_t;
init_unit_file(systemd_networkd_unit_t)
+type systemd_networkd_var_lib_t;
+files_type(systemd_networkd_var_lib_t)
+
type systemd_notify_t;
type systemd_notify_exec_t;
init_daemon_domain(systemd_notify_t, systemd_notify_exec_t)
@@ -1268,6 +1271,10 @@ manage_dirs_pattern(systemd_networkd_t,
systemd_networkd_runtime_t, systemd_netw
manage_files_pattern(systemd_networkd_t, systemd_networkd_runtime_t,
systemd_networkd_runtime_t)
manage_lnk_files_pattern(systemd_networkd_t, systemd_networkd_runtime_t,
systemd_networkd_runtime_t)
+init_var_lib_filetrans(systemd_networkd_t, systemd_networkd_var_lib_t, dir)
+manage_dirs_pattern(systemd_networkd_t, systemd_networkd_var_lib_t,
systemd_networkd_var_lib_t)
+manage_files_pattern(systemd_networkd_t, systemd_networkd_var_lib_t,
systemd_networkd_var_lib_t)
+
kernel_read_system_state(systemd_networkd_t)
kernel_read_kernel_sysctls(systemd_networkd_t)
kernel_read_network_state(systemd_networkd_t)
