TakeV
/
guix
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

etc: SELinux: Allow daemon to search run state directories. 

* etc/guix-daemon.cil.in: Import types init_var_run_t and
system_dbusd_var_run_t; add rules.
This commit is contained in:
Ricardo Wurmus 2022-12-23 16:47:11 +01:00
parent f28d792719
commit 4a134ed32e
No known key found for this signature in database
GPG Key ID: 197A5888235FACAC
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
etc/guix-daemon.cil.in
View File

@ -1,6 +1,6 @@
; -*- lisp -*-
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2018, 2022 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2020 Daniel Brooks <db48x@db48x.net>
;;; Copyright © 2020 Marius Bakke <marius@gnu.org>
;;;
@ -37,11 +37,13 @@
(block guix_daemon
;; Require existing types
(typeattributeset cil_gen_require init_t)
(typeattributeset cil_gen_require tmp_t)
(typeattributeset cil_gen_require nscd_var_run_t)
(typeattributeset cil_gen_require var_log_t)
(typeattributeset cil_gen_require domain)
(typeattributeset cil_gen_require init_t)
(typeattributeset cil_gen_require init_var_run_t)
(typeattributeset cil_gen_require nscd_var_run_t)
(typeattributeset cil_gen_require system_dbusd_var_run_t)
(typeattributeset cil_gen_require tmp_t)
(typeattributeset cil_gen_require var_log_t)
;; Declare own types
(type guix_daemon_t)
@ -284,6 +286,14 @@
guix_store_content_t
(sock_file (create getattr setattr unlink write)))
;; Access to run state directories
(allow guix_daemon_t
system_dbusd_var_run_t
(dir (search)))
(allow guix_daemon_t
init_var_run_t
(dir (search)))
;; Access to configuration files and directories
(allow guix_daemon_t
guix_daemon_conf_t