diff --git a/policy/modules/services/accountsd.if b/policy/modules/services/accountsd.if index 292dadd1..c0f858de 100644 --- a/policy/modules/services/accountsd.if +++ b/policy/modules/services/accountsd.if @@ -18,6 +18,46 @@ interface(`accountsd_domtrans',` domtrans_pattern($1, accountsd_exec_t, accountsd_t) ') +######################################## +## +## Do not audit attempts to read and write Accounts Daemon +## fifo file. +## +## +## +## Domain allowed access. +## +## +# +interface(`accountsd_dontaudit_rw_fifo_file',` + gen_require(` + type accountsd_t; + ') + + dontaudit $1 accountsd_t:fifo_file rw_fifo_file_perms; +') + +######################################## +## +## Send and receive messages from +## accountsd over dbus. +## +## +## +## Domain allowed access. +## +## +# +interface(`accountsd_dbus_chat',` + gen_require(` + type accountsd_t; + class dbus send_msg; + ') + + allow $1 accountsd_t:dbus send_msg; + allow accountsd_t $1:dbus send_msg; +') + ######################################## ## ## Search accountsd lib directories. @@ -76,46 +116,6 @@ interface(`accountsd_manage_lib_files',` manage_files_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t) ') -######################################## -## -## Send and receive messages from -## accountsd over dbus. -## -## -## -## Domain allowed access. -## -## -# -interface(`accountsd_dbus_chat',` - gen_require(` - type accountsd_t; - class dbus send_msg; - ') - - allow $1 accountsd_t:dbus send_msg; - allow accountsd_t $1:dbus send_msg; -') - -######################################## -## -## Do not audit attempts to read and write Accounts Daemon -## fifo file. -## -## -## -## Domain allowed access. -## -## -# -interface(`accountsd_dontaudit_rw_fifo_file',` - gen_require(` - type accountsd_t; - ') - - dontaudit $1 accountsd_t:fifo_file rw_inherited_fifo_file_perms; -') - ######################################## ## ## All of the rules required to administrate @@ -137,8 +137,9 @@ interface(`accountsd_admin',` gen_require(` type accountsd_t; ') + allow $1 accountsd_t:process { ptrace signal_perms getattr }; - read_files_pattern($1, accountsd_t, accountsd_t) + ps_process_pattern($1, accountsd_t) accountsd_manage_lib_files($1) ') diff --git a/policy/modules/services/accountsd.te b/policy/modules/services/accountsd.te index eced3f6d..1632f105 100644 --- a/policy/modules/services/accountsd.te +++ b/policy/modules/services/accountsd.te @@ -16,13 +16,13 @@ files_type(accountsd_var_lib_t) # # accountsd local policy # -allow accountsd_t self:capability { dac_override setuid setgid sys_ptrace }; +allow accountsd_t self:capability { dac_override setuid setgid sys_ptrace }; allow accountsd_t self:fifo_file rw_fifo_file_perms; manage_dirs_pattern(accountsd_t, accountsd_var_lib_t, accountsd_var_lib_t) manage_files_pattern(accountsd_t, accountsd_var_lib_t, accountsd_var_lib_t) -files_var_lib_filetrans(accountsd_t, accountsd_var_lib_t, { file dir } ) +files_var_lib_filetrans(accountsd_t, accountsd_var_lib_t, { file dir }) kernel_read_kernel_sysctls(accountsd_t)