|
 |
ffb2b6 |
diff --git a/certmonger.te b/certmonger.te
|
|
|
ffb2b6 |
index 0585431e14..26d4e132ce 100644
|
|
|
ffb2b6 |
--- a/certmonger.te
|
|
|
ffb2b6 |
+++ b/certmonger.te
|
|
|
ffb2b6 |
@@ -136,6 +136,10 @@ optional_policy(`
|
|
|
ffb2b6 |
kerberos_filetrans_named_content(certmonger_t)
|
|
|
ffb2b6 |
')
|
|
|
ffb2b6 |
|
|
|
ffb2b6 |
+optional_policy(`
|
|
|
ffb2b6 |
+ mta_send_mail(certmonger_t)
|
|
|
ffb2b6 |
+')
|
|
|
ffb2b6 |
+
|
|
|
ffb2b6 |
optional_policy(`
|
|
|
ffb2b6 |
pcscd_read_pid_files(certmonger_t)
|
|
|
ffb2b6 |
pcscd_stream_connect(certmonger_t)
|
|
|
931132 |
diff --git a/snapper.te b/snapper.te
|
|
|
931132 |
index faf4fc9fca..fda6e0b289 100644
|
|
|
931132 |
--- a/snapper.te
|
|
|
931132 |
+++ b/snapper.te
|
|
|
931132 |
@@ -22,6 +22,8 @@ files_type(snapperd_data_t)
|
|
|
931132 |
#
|
|
|
931132 |
# snapperd local policy
|
|
|
931132 |
#
|
|
|
931132 |
+allow snapperd_t self:capability { dac_read_search fowner sys_admin };
|
|
|
931132 |
+allow snapperd_t self:process setsched;
|
|
|
931132 |
|
|
|
931132 |
allow snapperd_t self:fifo_file rw_fifo_file_perms;
|
|
|
931132 |
allow snapperd_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
931132 |
@@ -36,8 +38,12 @@ manage_lnk_files_pattern(snapperd_t, snapperd_conf_t, snapperd_conf_t)
|
|
|
931132 |
manage_files_pattern(snapperd_t, snapperd_data_t, snapperd_data_t)
|
|
|
931132 |
manage_dirs_pattern(snapperd_t, snapperd_data_t, snapperd_data_t)
|
|
|
931132 |
manage_lnk_files_pattern(snapperd_t, snapperd_data_t, snapperd_data_t)
|
|
|
931132 |
+allow snapperd_t snapperd_data_t:file relabelfrom;
|
|
|
931132 |
+allow snapperd_t snapperd_data_t:dir { relabelfrom relabelto mounton };
|
|
|
931132 |
snapper_filetrans_named_content(snapperd_t)
|
|
|
931132 |
|
|
|
931132 |
+kernel_setsched(snapperd_t)
|
|
|
931132 |
+
|
|
|
931132 |
domain_read_all_domains_state(snapperd_t)
|
|
|
931132 |
|
|
|
931132 |
corecmd_exec_shell(snapperd_t)
|
|
|
931132 |
@@ -51,6 +57,8 @@ files_read_all_files(snapperd_t)
|
|
|
931132 |
files_list_all(snapperd_t)
|
|
|
931132 |
|
|
|
931132 |
fs_getattr_all_fs(snapperd_t)
|
|
|
931132 |
+fs_mount_xattr_fs(snapperd_t)
|
|
|
931132 |
+fs_unmount_xattr_fs(snapperd_t)
|
|
|
931132 |
|
|
|
931132 |
storage_raw_read_fixed_disk(snapperd_t)
|
|
|
931132 |
|
|
|
96c579 |
diff --git a/virt.te b/virt.te
|
|
|
96c579 |
index d4245b7168..51a9cd851d 100644
|
|
|
96c579 |
--- a/virt.te
|
|
|
96c579 |
+++ b/virt.te
|
|
|
96c579 |
@@ -766,6 +766,11 @@ optional_policy(`
|
|
|
96c579 |
dbus_system_bus_client(virtlogd_t)
|
|
|
96c579 |
')
|
|
|
96c579 |
|
|
|
96c579 |
+optional_policy(`
|
|
|
96c579 |
+ systemd_write_inhibit_pipes(virtlogd_t)
|
|
|
96c579 |
+ systemd_dbus_chat_logind(virtlogd_t)
|
|
|
96c579 |
+')
|
|
|
96c579 |
+
|
|
|
96c579 |
########################################
|
|
|
96c579 |
#
|
|
|
96c579 |
# virtual domains common policy
|