diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc index 489edccfde..569096ba39 100644 --- a/policy/modules/system/init.fc +++ b/policy/modules/system/init.fc @@ -56,7 +56,7 @@ ifdef(`distro_gentoo', ` /usr/lib/systemd/[^/]* -- gen_context(system_u:object_r:init_exec_t,s0) /usr/lib/systemd/fedora[^/]* -- gen_context(system_u:object_r:initrc_exec_t,s0) -/usr/lib/systemd/system-generators/[^/]* -- gen_context(system_u:object_r:init_exec_t,s0) +#/usr/lib/systemd/system-generators/[^/]* -- gen_context(system_u:object_r:init_exec_t,s0) /usr/libexec/dcc/start-.* -- gen_context(system_u:object_r:initrc_exec_t,s0) /usr/libexec/dcc/stop-.* -- gen_context(system_u:object_r:initrc_exec_t,s0) diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc index 29e7ffddf3..fbfeb44151 100644 --- a/policy/modules/system/systemd.fc +++ b/policy/modules/system/systemd.fc @@ -72,6 +72,7 @@ HOME_DIR/\.config/systemd/user(/.*)? gen_context(system_u:object_r:systemd_unit /usr/lib/systemd/system-generators/systemd-gpt-auto-generator -- gen_context(system_u:object_r:systemd_gpt_generator_exec_t,s0) /usr/lib/systemd/system-generators/systemd-rc-local-generator -- gen_context(system_u:object_r:systemd_rc_local_generator_exec_t,s0) /usr/lib/systemd/system-generators/systemd-sysv-generator -- gen_context(system_u:object_r:systemd_sysv_generator_exec_t,s0) +/usr/lib/systemd/system-generators/.+ -- gen_context(system_u:object_r:systemd_generic_generator_exec_t,s0) /usr/lib/systemd/systemd-resolve(d|-host) gen_context(system_u:object_r:systemd_resolved_exec_t,s0) /usr/lib/systemd/systemd-importd -- gen_context(system_u:object_r:systemd_importd_exec_t,s0) /usr/lib/systemd/systemd-journal-upload -- gen_context(system_u:object_r:systemd_journal_upload_exec_t,s0) diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if index dca99a7cb6..d6cdf20ff5 100644 --- a/policy/modules/system/systemd.if +++ b/policy/modules/system/systemd.if @@ -60,6 +60,40 @@ template(`systemd_generator_template',` systemd_create_unit_file_lnk($1_t) ') +###################################### +## +## Creates types and rules for +## systemd generators - new version +## +## +## +## Prefix for the domain. +## +## +# +template(`systemd_generator_template_new',` + gen_require(` + attribute systemd_generator; + ') + + type $1_t, systemd_generator; + type $1_exec_t; + init_daemon_domain($1_t, $1_exec_t) + init_nnp_daemon_domain($1_t) + + #kernel_read_system_state($1_t) + + #dev_write_kmsg($1_t) + + #auth_use_nsswitch($1_t) + #selinux_get_enforce_mode($1_t) + + #systemd_manage_unit_dirs($1_t) + #systemd_create_unit_file_dirs($1_t) + #systemd_create_unit_file_lnk($1_t) + permissive $1_t; +') + ###################################### ## ## Create a domain for processes which are started diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index b3512c726d..0fcfd0a46c 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -202,6 +202,9 @@ systemd_generator_template(systemd_rc_local_generator) #domain for sysv-generator systemd_generator_template(systemd_sysv_generator) +#domain for a generic generator +systemd_generator_template_new(systemd_generic_generator) + #domain for systemd-machined systemd_domain_template(systemd_machined)