From a1a9a59f93ebfe6d0c9d725ed0712210994e6d64 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 6 Apr 2021 16:06:48 +0200 Subject: [PATCH] Allow fapolicyd watch boot and home directories The fapolicyd service needs watch_mount and watch_with_perm permissions for fanotify/inotify/dnotify calls on the following directories: - /boot and /boot/efi directories - /home directories Note the /boot/efi directory has the dosfs_t label. --- fapolicyd.te | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te index f5d0052..c12f385 100644 --- a/fapolicyd-selinux-0.4/fapolicyd.te +++ b/fapolicyd-selinux-0.4/fapolicyd.te @@ -63,14 +63,20 @@ domain_read_all_domains_state(fapolicyd_t) files_mmap_usr_files(fapolicyd_t) files_read_all_files(fapolicyd_t) +files_watch_mount_boot_dirs(fapolicyd_t) +files_watch_with_perm_boot_dirs(fapolicyd_t) files_watch_mount_generic_tmp_dirs(fapolicyd_t) files_watch_with_perm_generic_tmp_dirs(fapolicyd_t) +files_watch_mount_home(fapolicyd_t) +files_watch_with_perm_home(fapolicyd_t) files_watch_mount_root_dirs(fapolicyd_t) files_watch_with_perm_root_dirs(fapolicyd_t) fs_getattr_xattr_fs(fapolicyd_t) fs_watch_mount_tmpfs_dirs(fapolicyd_t) fs_watch_with_perm_tmpfs_dirs(fapolicyd_t) +fs_watch_mount_dos_dirs(fapolicyd_t) +fs_watch_with_perm_dos_dirs(fapolicyd_t) logging_send_syslog_msg(fapolicyd_t) dbus_system_bus_client(fapolicyd_t)