cb1e3ca81e
- statically linked app can execute untrusted app Resolves: rhbz#2097077 - fapolicyd ineffective with systemd DynamicUser=yes Resolves: rhbz#2136802 - Starting manually fapolicyd while the service is already running breaks the system Resolves: rhbz#2160517 - Cannot execute /usr/libexec/grepconf.sh when falcon-sensor is enabled Resolves: rhbz#2160518 Signed-off-by: Radovan Sroka <rsroka@redhat.com>
20 lines
795 B
Diff
20 lines
795 B
Diff
diff -up ./fapolicyd-selinux-0.4/fapolicyd.te.selinux2 ./fapolicyd-selinux-0.4/fapolicyd.te
|
|
--- ./fapolicyd-selinux-0.4/fapolicyd.te.selinux2 2022-11-11 10:46:51.016420807 +0100
|
|
+++ ./fapolicyd-selinux-0.4/fapolicyd.te 2022-11-11 10:47:25.161793205 +0100
|
|
@@ -39,10 +39,15 @@ allow fapolicyd_t self:unix_dgram_socket
|
|
|
|
gen_require(`
|
|
attribute file_type;
|
|
+ attribute filesystem_type;
|
|
+ attribute mountpoint;
|
|
')
|
|
allow fapolicyd_t file_type:dir { watch_mount watch_with_perm };
|
|
allow fapolicyd_t file_type:file { watch_mount watch_with_perm };
|
|
|
|
+allow fapolicyd_t filesystem_type : filesystem { watch };
|
|
+allow fapolicyd_t mountpoint : dir { watch_sb };
|
|
+
|
|
manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t)
|
|
logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file)
|
|
|