diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index 8ade7e61..c390959f 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -1903,6 +1903,25 @@ interface(`files_relabel_etc_files',` allow $1 etc_t:file { relabelfrom relabelto }; ') +######################################## +## +## Read symbolic links in /etc. +## +## +## +## Domain allowed access. +## +## +# +interface(`files_read_etc_symlinks',` + gen_require(` + type etc_t; + ') + + allow $1 etc_t:dir search_dir_perms; + allow $1 etc_t:lnk_file { getattr read }; +') + ######################################## ## ## Create objects in /etc with a private diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te index d397dcac..dea8e5ca 100644 --- a/policy/modules/kernel/files.te +++ b/policy/modules/kernel/files.te @@ -1,5 +1,5 @@ -policy_module(files,1.2.15) +policy_module(files,1.2.16) ######################################## # diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if index 549b4fbf..bcaddcd8 100644 --- a/policy/modules/system/miscfiles.if +++ b/policy/modules/system/miscfiles.if @@ -106,8 +106,7 @@ interface(`miscfiles_read_localization',` type locale_t; ') - files_search_etc($1) - # FIXME: $1 read etc_t:lnk_file here + files_read_etc_symlinks($1) files_search_usr($1) allow $1 locale_t:dir r_dir_perms; allow $1 locale_t:lnk_file r_file_perms; diff --git a/policy/modules/system/miscfiles.te b/policy/modules/system/miscfiles.te index 0e18a689..819d71bf 100644 --- a/policy/modules/system/miscfiles.te +++ b/policy/modules/system/miscfiles.te @@ -1,5 +1,5 @@ -policy_module(miscfiles,1.0.4) +policy_module(miscfiles,1.0.5) ######################################## #