|
 |
9c5c8d |
diff --git a/policy/modules/admin/sudo.if b/policy/modules/admin/sudo.if
|
|
|
9c5c8d |
index b6debf340..329eb3922 100644
|
|
|
9c5c8d |
--- a/policy/modules/admin/sudo.if
|
|
|
9c5c8d |
+++ b/policy/modules/admin/sudo.if
|
|
|
9c5c8d |
@@ -55,6 +55,7 @@ template(`sudo_role_template',`
|
|
|
9c5c8d |
files_tmp_filetrans($1_sudo_t, $1_sudo_tmp_t, file)
|
|
|
9c5c8d |
|
|
|
9c5c8d |
allow $1_sudo_t $3:dir search_dir_perms;;
|
|
|
9c5c8d |
+ allow $1_sudo_t $3:file read_file_perms;;
|
|
|
9c5c8d |
allow $1_sudo_t $3:key search;
|
|
|
9c5c8d |
|
|
|
9c5c8d |
# Enter this derived domain from the user domain
|
|
|
9c5c8d |
diff --git a/policy/modules/admin/sudo.te b/policy/modules/admin/sudo.te
|
|
|
9c5c8d |
index 5c11b48e1..ef069d779 100644
|
|
|
9c5c8d |
--- a/policy/modules/admin/sudo.te
|
|
|
9c5c8d |
+++ b/policy/modules/admin/sudo.te
|
|
|
9c5c8d |
@@ -119,6 +119,10 @@ optional_policy(`
|
|
|
9c5c8d |
')
|
|
|
9c5c8d |
')
|
|
|
9c5c8d |
|
|
|
9c5c8d |
+optional_policy(`
|
|
|
9c5c8d |
+ systemd_write_inherited_logind_sessions_pipes(sudodomain)
|
|
|
9c5c8d |
+')
|
|
|
9c5c8d |
+
|
|
|
9c5c8d |
optional_policy(`
|
|
|
9c5c8d |
fprintd_dbus_chat(sudodomain)
|
|
|
9c5c8d |
')
|
|
|
9c5c8d |
diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
|
|
|
9c5c8d |
index 5fa83a2fb..34fd0b0f1 100644
|
|
|
9c5c8d |
--- a/policy/modules/kernel/domain.if
|
|
|
9c5c8d |
+++ b/policy/modules/kernel/domain.if
|
|
|
9c5c8d |
@@ -602,6 +602,42 @@ interface(`domain_search_all_domains_state',`
|
|
|
9c5c8d |
allow $1 domain:dir search_dir_perms;
|
|
|
9c5c8d |
')
|
|
|
9c5c8d |
|
|
|
9c5c8d |
+########################################
|
|
|
9c5c8d |
+## <summary>
|
|
|
9c5c8d |
+## Allow read and write of process kernel keyrings
|
|
|
9c5c8d |
+## </summary>
|
|
|
9c5c8d |
+## <param name="domain">
|
|
|
9c5c8d |
+## <summary>
|
|
|
9c5c8d |
+## Domain to dontaudit.
|
|
|
9c5c8d |
+## </summary>
|
|
|
9c5c8d |
+## </param>
|
|
|
9c5c8d |
+#
|
|
|
9c5c8d |
+interface(`domain_rw_all_domains_keyrings',`
|
|
|
9c5c8d |
+ gen_require(`
|
|
|
9c5c8d |
+ attribute domain;
|
|
|
9c5c8d |
+ ')
|
|
|
9c5c8d |
+
|
|
|
9c5c8d |
+ allow $1 domain:key { read write};
|
|
|
9c5c8d |
+')
|
|
|
9c5c8d |
+
|
|
|
9c5c8d |
+########################################
|
|
|
9c5c8d |
+## <summary>
|
|
|
9c5c8d |
+## Allow manage of process kernel keyrings
|
|
|
9c5c8d |
+## </summary>
|
|
|
9c5c8d |
+## <param name="domain">
|
|
|
9c5c8d |
+## <summary>
|
|
|
9c5c8d |
+## Domain to dontaudit.
|
|
|
9c5c8d |
+## </summary>
|
|
|
9c5c8d |
+## </param>
|
|
|
9c5c8d |
+#
|
|
|
9c5c8d |
+interface(`domain_manage_all_domains_keyrings',`
|
|
|
9c5c8d |
+ gen_require(`
|
|
|
9c5c8d |
+ attribute domain;
|
|
|
9c5c8d |
+ ')
|
|
|
9c5c8d |
+
|
|
|
9c5c8d |
+ allow $1 domain:key manage_key_perms;
|
|
|
9c5c8d |
+')
|
|
|
9c5c8d |
+
|
|
|
9c5c8d |
########################################
|
|
|
9c5c8d |
## <summary>
|
|
|
9c5c8d |
## Do not audit attempts to search the process
|
|
|
9c5c8d |
diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
|
|
|
9c5c8d |
index c03a52c04..8569b19db 100644
|
|
|
9c5c8d |
--- a/policy/modules/roles/staff.te
|
|
|
9c5c8d |
+++ b/policy/modules/roles/staff.te
|
|
|
9c5c8d |
@@ -55,6 +55,7 @@ storage_read_scsi_generic(staff_t)
|
|
|
9c5c8d |
storage_write_scsi_generic(staff_t)
|
|
|
9c5c8d |
|
|
|
9c5c8d |
term_use_unallocated_ttys(staff_t)
|
|
|
9c5c8d |
+term_use_generic_ptys(staff_t)
|
|
|
9c5c8d |
|
|
|
9c5c8d |
auth_domtrans_pam_console(staff_t)
|
|
|
9c5c8d |
|
|
|
9c5c8d |
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
|
|
|
9c5c8d |
index 8f75416ce..d5f2f5b4a 100644
|
|
|
9c5c8d |
--- a/policy/modules/system/systemd.if
|
|
|
9c5c8d |
+++ b/policy/modules/system/systemd.if
|
|
|
9c5c8d |
@@ -351,6 +351,26 @@ interface(`systemd_use_fds_logind',`
|
|
|
9c5c8d |
allow $1 systemd_logind_t:fd use;
|
|
|
9c5c8d |
')
|
|
|
9c5c8d |
|
|
|
9c5c8d |
+########################################
|
|
|
9c5c8d |
+## <summary>
|
|
|
9c5c8d |
+## Read the process state (/proc/pid) of systemd_logind_t.
|
|
|
9c5c8d |
+## </summary>
|
|
|
9c5c8d |
+## <param name="domain">
|
|
|
9c5c8d |
+## <summary>
|
|
|
9c5c8d |
+## Domain allowed access.
|
|
|
9c5c8d |
+## </summary>
|
|
|
9c5c8d |
+## </param>
|
|
|
9c5c8d |
+#
|
|
|
9c5c8d |
+interface(`systemd_logind_read_state',`
|
|
|
9c5c8d |
+ gen_require(`
|
|
|
9c5c8d |
+ type systemd_logind_t;
|
|
|
9c5c8d |
+ ')
|
|
|
9c5c8d |
+
|
|
|
9c5c8d |
+ allow $1 systemd_logind_t:dir search_dir_perms;
|
|
|
9c5c8d |
+ allow $1 systemd_logind_t:file read_file_perms;
|
|
|
9c5c8d |
+ allow $1 systemd_logind_t:lnk_file read_lnk_file_perms;
|
|
|
9c5c8d |
+')
|
|
|
9c5c8d |
+
|
|
|
9c5c8d |
######################################
|
|
|
9c5c8d |
## <summary>
|
|
|
9c5c8d |
## Read logind sessions files.
|
|
|
9c5c8d |
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
|
|
|
9c5c8d |
index cceb511fc..f5139efd2 100644
|
|
|
9c5c8d |
--- a/policy/modules/system/userdomain.te
|
|
|
9c5c8d |
+++ b/policy/modules/system/userdomain.te
|
|
|
9c5c8d |
@@ -381,6 +381,7 @@ dontaudit confined_admindomain self:socket create;
|
|
|
9c5c8d |
|
|
|
9c5c8d |
allow confined_admindomain user_devpts_t:chr_file { setattr rw_chr_file_perms };
|
|
|
9c5c8d |
term_create_pty(confined_admindomain, user_devpts_t)
|
|
|
9c5c8d |
+term_use_generic_ptys(confined_admindomain)
|
|
|
9c5c8d |
# avoid annoying messages on terminal hangup on role change
|
|
|
9c5c8d |
dontaudit confined_admindomain user_devpts_t:chr_file ioctl;
|
|
|
9c5c8d |
|