Confine vsftpd systemd system generator

Resolves: rhbz#2317180
zpytela · Dec 17, 2024 · 096c442 · 096c442
1 parent 0d528ae
commit 096c442
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
@@ -88,6 +88,7 @@ HOME_DIR/\.config/systemd/user(/.*)?		gen_context(system_u:object_r:systemd_unit
 /usr/lib/systemd/system-generators/systemd-ssh-generator	--	gen_context(system_u:object_r:systemd_ssh_generator_exec_t,s0)
 /usr/lib/systemd/system-generators/systemd-sysv-generator	--	gen_context(system_u:object_r:systemd_sysv_generator_exec_t,s0)
 /usr/lib/systemd/system-generators/systemd-tpm2-generator	--	gen_context(system_u:object_r:systemd_tpm2_generator_exec_t,s0)
+/usr/lib/systemd/system-generators/vsftpd-generator	--	gen_context(system_u:object_r:systemd_vsftpd_generator_exec_t,s0)
 /usr/lib/systemd/system-generators/zram-generator	--	gen_context(system_u:object_r:systemd_zram_generator_exec_t,s0)
 /usr/lib/systemd/system-generators/.+	--	gen_context(system_u:object_r:systemd_generic_generator_exec_t,s0)
 /usr/lib/systemd/zram-generator.conf	--	gen_context(system_u:object_r:systemd_zram_generator_conf_t,s0)

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
@@ -216,6 +216,8 @@ systemd_generator_template(systemd_ssh_generator)
 systemd_generator_template(systemd_sysv_generator)
 # tpm2-generator
 systemd_generator_template(systemd_tpm2_generator)
+# vsftpd-generator
+systemd_generator_template(systemd_vsftpd_generator)
 # zram-generator
 systemd_generator_template(systemd_zram_generator)
 type systemd_zram_generator_conf_t;
@@ -1396,6 +1398,14 @@ init_read_script_files(systemd_sysv_generator_t)
 ### tpm2 generator
 dev_read_sysfs(systemd_tpm2_generator_t)
 
+### vsftpd generator
+corecmd_exec_bin(systemd_vsftpd_generator_t)
+corecmd_exec_shell(systemd_vsftpd_generator_t)
+
+optional_policy(`
+	auth_dontaudit_read_passwd_file(systemd_vsftpd_generator_t)
+')
+
 ### zram generator
 allow systemd_zram_generator_t systemd_fstab_generator_unit_file_t:file write_file_perms;
 permissive systemd_zram_generator_t;