Draft: Update systemd-generators

zpytela · Dec 18, 2023 · ac03f39 · ac03f39
1 parent 12f821c
commit ac03f39
Show file tree

Hide file tree

Showing 3 changed files with 38 additions and 0 deletions.
diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
@@ -72,6 +72,7 @@ HOME_DIR/\.config/systemd/user(/.*)?		gen_context(system_u:object_r:systemd_unit
 /usr/lib/systemd/system-generators/systemd-gpt-auto-generator	--	gen_context(system_u:object_r:systemd_gpt_generator_exec_t,s0)
 /usr/lib/systemd/system-generators/systemd-rc-local-generator	--	gen_context(system_u:object_r:systemd_rc_local_generator_exec_t,s0)
 /usr/lib/systemd/system-generators/systemd-sysv-generator	--	gen_context(system_u:object_r:systemd_sysv_generator_exec_t,s0)
+/usr/lib/systemd/system-generators/.+	--	gen_context(system_u:object_r:systemd_generic_generator_exec_t,s0)
 /usr/lib/systemd/systemd-resolve(d|-host)			gen_context(system_u:object_r:systemd_resolved_exec_t,s0)
 /usr/lib/systemd/systemd-importd		--	gen_context(system_u:object_r:systemd_importd_exec_t,s0)
 /usr/lib/systemd/systemd-journal-upload		--	gen_context(system_u:object_r:systemd_journal_upload_exec_t,s0)

diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
@@ -60,6 +60,40 @@ template(`systemd_generator_template',`
 	systemd_create_unit_file_lnk($1_t)
 ')
 
+######################################
+## <summary>
+##  Creates types and rules for 
+##  systemd generators - new version
+## </summary>
+## <param name="prefix">
+##  <summary>
+##  Prefix for the domain.
+##  </summary>
+## </param>
+#
+template(`systemd_generator_template_new',`
+	gen_require(`
+		attribute systemd_generator;
+	')
+
+	type $1_t, systemd_generator;
+	type $1_exec_t;
+	init_daemon_domain($1_t, $1_exec_t)
+	init_nnp_daemon_domain($1_t)
+
+	#kernel_read_system_state($1_t)
+
+	#dev_write_kmsg($1_t)
+
+	#auth_use_nsswitch($1_t)
+	#selinux_get_enforce_mode($1_t)
+
+	#systemd_manage_unit_dirs($1_t)
+	#systemd_create_unit_file_dirs($1_t)
+	#systemd_create_unit_file_lnk($1_t)
+	permissive $1_t;
+')
+
 ######################################
 ## <summary>
 ##      Create a domain for processes which are started 

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
@@ -202,6 +202,9 @@ systemd_generator_template(systemd_rc_local_generator)
 #domain for sysv-generator
 systemd_generator_template(systemd_sysv_generator)
 
+#domain for a generic generator
+systemd_generator_template_new(systemd_generic_generator)
+
 #domain for systemd-machined
 systemd_domain_template(systemd_machined)