From a1a9a59f93ebfe6d0c9d725ed0712210994e6d64 Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Tue, 6 Apr 2021 16:06:48 +0200
Subject: [PATCH] Allow fapolicyd watch boot and home directories

The fapolicyd service needs watch_mount and watch_with_perm permissions
for fanotify/inotify/dnotify calls on the following directories:
- /boot and /boot/efi directories
- /home directories

Note the /boot/efi directory has the dosfs_t label.
---
 fapolicyd.te | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te
index f5d0052..c12f385 100644
--- a/fapolicyd-selinux-0.4/fapolicyd.te
+++ b/fapolicyd-selinux-0.4/fapolicyd.te
@@ -63,14 +63,20 @@ domain_read_all_domains_state(fapolicyd_t)
 
 files_mmap_usr_files(fapolicyd_t)
 files_read_all_files(fapolicyd_t)
+files_watch_mount_boot_dirs(fapolicyd_t)
+files_watch_with_perm_boot_dirs(fapolicyd_t)
 files_watch_mount_generic_tmp_dirs(fapolicyd_t)
 files_watch_with_perm_generic_tmp_dirs(fapolicyd_t)
+files_watch_mount_home(fapolicyd_t)
+files_watch_with_perm_home(fapolicyd_t)
 files_watch_mount_root_dirs(fapolicyd_t)
 files_watch_with_perm_root_dirs(fapolicyd_t)
 
 fs_getattr_xattr_fs(fapolicyd_t)
 fs_watch_mount_tmpfs_dirs(fapolicyd_t)
 fs_watch_with_perm_tmpfs_dirs(fapolicyd_t)
+fs_watch_mount_dos_dirs(fapolicyd_t)
+fs_watch_with_perm_dos_dirs(fapolicyd_t)
 
 logging_send_syslog_msg(fapolicyd_t)
 dbus_system_bus_client(fapolicyd_t)