From 6a966a3ee89233a0a055712f39ca564ba91183bf Mon Sep 17 00:00:00 2001

From: Zdenek Pytela <zpytela@redhat.com>

Date: Thu, 15 Apr 2021 16:56:08 +0200

Subject: [PATCH] Allow fapolicyd watch_mount/watch_with_perm all files and

 directories

For the fanotify_mark() syscall, fapolicyd uses the FAN_MARK_MOUNT flag

to mark the file's mount point to monitor. As this can be any file or

directory on the filesystem, the SELinux watch_mount and watch_with_perm

permissions are allowed for the file_type attribute.

---

 fapolicyd.te | 6 ++++++

 1 file changed, 6 insertions(+)

diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te

index c12f385..582e03f 100644

--- a/fapolicyd-selinux-0.4/fapolicyd.te

+++ b/fapolicyd-selinux-0.4/fapolicyd.te

@@ -36,6 +36,12 @@ allow fapolicyd_t self:process { setcap setsched };

 allow fapolicyd_t self:unix_stream_socket create_stream_socket_perms;

 allow fapolicyd_t self:unix_dgram_socket create_socket_perms;

+gen_require(`

+	attribute file_type;

+')

+allow fapolicyd_t file_type:dir { watch_mount watch_with_perm };

+allow fapolicyd_t file_type:file { watch_mount watch_with_perm };

+

 manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t)

 logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file)