diff --git a/policy/modules/services/tgtd.if b/policy/modules/services/tgtd.if index b113b41..74beaaa 100644 --- a/policy/modules/services/tgtd.if +++ b/policy/modules/services/tgtd.if @@ -26,3 +26,21 @@ interface(`tgtd_rw_semaphores',` allow $1 tgtd_t:sem rw_sem_perms; ') + +###################################### +## +## Manage tgtd sempaphores. +## +## +## +## Domain allowed access. +## +## +# +interface(`tgtd_manage_semaphores',` + gen_require(` + type tgtd_t; + ') + + allow $1 tgtd_t:sem create_sem_perms; +') diff --git a/policy/modules/services/tgtd.te b/policy/modules/services/tgtd.te index debff69..108631e 100644 --- a/policy/modules/services/tgtd.te +++ b/policy/modules/services/tgtd.te @@ -67,4 +67,6 @@ logging_send_syslog_msg(tgtd_t) miscfiles_read_localization(tgtd_t) -iscsi_manage_semaphores(tgtd_t) +optional_policy(` + iscsi_manage_semaphores(tgtd_t) +') diff --git a/policy/modules/system/iscsi.te b/policy/modules/system/iscsi.te index 0787687..3ab3a47 100644 --- a/policy/modules/system/iscsi.te +++ b/policy/modules/system/iscsi.te @@ -93,5 +93,5 @@ logging_send_syslog_msg(iscsid_t) miscfiles_read_localization(iscsid_t) optional_policy(` - tgtd_rw_semaphores(iscsid_t) + tgtd_manage_semaphores(iscsid_t) ')