diff --git a/policy/modules/admin/readahead.fc b/policy/modules/admin/readahead.fc index 09cc902..7077413 100644 --- a/policy/modules/admin/readahead.fc +++ b/policy/modules/admin/readahead.fc @@ -1,3 +1,3 @@ -/etc/readahead.d(/.*)? gen_context(system_u:object_r:readahead_etc_rw_t,s0) - -/usr/sbin/readahead -- gen_context(system_u:object_r:readahead_exec_t,s0) +/usr/sbin/readahead.* -- gen_context(system_u:object_r:readahead_exec_t,s0) +/sbin/readahead.* -- gen_context(system_u:object_r:readahead_exec_t,s0) +/var/lib/readahead(/.*)? gen_context(system_u:object_r:readahead_var_lib_t,s0) diff --git a/policy/modules/admin/readahead.te b/policy/modules/admin/readahead.te index 59dd131..5a2f4d7 100644 --- a/policy/modules/admin/readahead.te +++ b/policy/modules/admin/readahead.te @@ -1,5 +1,5 @@ -policy_module(readahead, 1.8.0) +policy_module(readahead, 1.8.1) ######################################## # @@ -11,8 +11,9 @@ type readahead_exec_t; init_daemon_domain(readahead_t, readahead_exec_t) application_domain(readahead_t, readahead_exec_t) -type readahead_etc_rw_t; -files_pid_file(readahead_etc_rw_t) +type readahead_var_lib_t; +files_type(readahead_var_lib_t) +typealias readahead_var_lib_t alias readahead_etc_rw_t; type readahead_var_run_t; files_pid_file(readahead_var_run_t) @@ -23,15 +24,17 @@ files_pid_file(readahead_var_run_t) # allow readahead_t self:capability { fowner dac_override dac_read_search }; -dontaudit readahead_t self:capability sys_tty_config; -allow readahead_t self:process signal_perms; +dontaudit readahead_t self:capability { net_admin sys_tty_config }; +allow readahead_t self:process { setsched signal_perms }; -manage_files_pattern(readahead_t, readahead_etc_rw_t, readahead_etc_rw_t) +manage_dirs_pattern(readahead_t, readahead_var_lib_t, readahead_var_lib_t) +manage_files_pattern(readahead_t, readahead_var_lib_t, readahead_var_lib_t) +files_search_var_lib(readahead_t) manage_files_pattern(readahead_t, readahead_var_run_t, readahead_var_run_t) files_pid_filetrans(readahead_t, readahead_var_run_t, file) -kernel_read_kernel_sysctls(readahead_t) +kernel_read_all_sysctls(readahead_t) kernel_read_system_state(readahead_t) kernel_dontaudit_getattr_core_if(readahead_t) @@ -46,10 +49,12 @@ dev_dontaudit_getattr_nvram_dev(readahead_t) storage_raw_read_fixed_disk(readahead_t) domain_use_interactive_fds(readahead_t) +domain_read_all_domains_state(readahead_t) files_dontaudit_getattr_all_sockets(readahead_t) files_list_non_security(readahead_t) files_read_non_security_files(readahead_t) +files_create_boot_flag(readahead_t) fs_getattr_all_fs(readahead_t) fs_search_auto_mountpoints(readahead_t) @@ -58,6 +63,7 @@ fs_getattr_all_files(readahead_t) fs_dontaudit_search_ramfs(readahead_t) fs_dontaudit_read_ramfs_pipes(readahead_t) fs_dontaudit_read_ramfs_files(readahead_t) +fs_dontaudit_use_tmpfs_chr_dev(readahead_t) fs_read_tmpfs_symlinks(readahead_t) fs_list_inotifyfs(readahead_t) @@ -72,6 +78,7 @@ init_use_script_ptys(readahead_t) init_getattr_initctl(readahead_t) logging_send_syslog_msg(readahead_t) +logging_set_audit_parameters(readahead_t) logging_dontaudit_search_audit_config(readahead_t) miscfiles_read_localization(readahead_t)