41 lines
1.5 KiB
Diff
41 lines
1.5 KiB
Diff
From a1a9a59f93ebfe6d0c9d725ed0712210994e6d64 Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Tue, 6 Apr 2021 16:06:48 +0200
|
|
Subject: [PATCH] Allow fapolicyd watch boot and home directories
|
|
|
|
The fapolicyd service needs watch_mount and watch_with_perm permissions
|
|
for fanotify/inotify/dnotify calls on the following directories:
|
|
- /boot and /boot/efi directories
|
|
- /home directories
|
|
|
|
Note the /boot/efi directory has the dosfs_t label.
|
|
---
|
|
fapolicyd.te | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te
|
|
index f5d0052..c12f385 100644
|
|
--- a/fapolicyd-selinux-0.4/fapolicyd.te
|
|
+++ b/fapolicyd-selinux-0.4/fapolicyd.te
|
|
@@ -63,14 +63,20 @@ domain_read_all_domains_state(fapolicyd_t)
|
|
|
|
files_mmap_usr_files(fapolicyd_t)
|
|
files_read_all_files(fapolicyd_t)
|
|
+files_watch_mount_boot_dirs(fapolicyd_t)
|
|
+files_watch_with_perm_boot_dirs(fapolicyd_t)
|
|
files_watch_mount_generic_tmp_dirs(fapolicyd_t)
|
|
files_watch_with_perm_generic_tmp_dirs(fapolicyd_t)
|
|
+files_watch_mount_home(fapolicyd_t)
|
|
+files_watch_with_perm_home(fapolicyd_t)
|
|
files_watch_mount_root_dirs(fapolicyd_t)
|
|
files_watch_with_perm_root_dirs(fapolicyd_t)
|
|
|
|
fs_getattr_xattr_fs(fapolicyd_t)
|
|
fs_watch_mount_tmpfs_dirs(fapolicyd_t)
|
|
fs_watch_with_perm_tmpfs_dirs(fapolicyd_t)
|
|
+fs_watch_mount_dos_dirs(fapolicyd_t)
|
|
+fs_watch_with_perm_dos_dirs(fapolicyd_t)
|
|
|
|
logging_send_syslog_msg(fapolicyd_t)
|
|
dbus_system_bus_client(fapolicyd_t)
|