ac19f1ac26
rtkit_daemon_system_domain interface allows domains to say rtkit can setsched on their process. Needs sys_nice capability Needs to getsched on all domains. Fix bug in te file Me: changed interface name from rtkit_daemon_system_domain to rtkit_schedule Already had sys_nice capability
37 lines
799 B
Plaintext
37 lines
799 B
Plaintext
|
|
policy_module(rtkit, 1.0.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type rtkit_daemon_t;
|
|
type rtkit_daemon_exec_t;
|
|
dbus_system_domain(rtkit_daemon_t, rtkit_daemon_exec_t)
|
|
|
|
########################################
|
|
#
|
|
# rtkit_daemon local policy
|
|
#
|
|
|
|
allow rtkit_daemon_t self:capability { dac_read_search setuid sys_chroot setgid sys_nice sys_ptrace };
|
|
allow rtkit_daemon_t self:process { setsched getcap setcap setrlimit };
|
|
|
|
kernel_read_system_state(rtkit_daemon_t)
|
|
|
|
domain_getsched_all_domains(rtkit_daemon_t)
|
|
domain_read_all_domains_state(rtkit_daemon_t)
|
|
|
|
fs_rw_anon_inodefs_files(rtkit_daemon_t)
|
|
|
|
auth_use_nsswitch(rtkit_daemon_t)
|
|
|
|
logging_send_syslog_msg(rtkit_daemon_t)
|
|
|
|
miscfiles_read_localization(rtkit_daemon_t)
|
|
|
|
optional_policy(`
|
|
policykit_dbus_chat(rtkit_daemon_t)
|
|
')
|