diff --git a/refpolicy/policy/modules/system/domain.if b/refpolicy/policy/modules/system/domain.if index 9b65ac4..ebcb4d2 100644 --- a/refpolicy/policy/modules/system/domain.if +++ b/refpolicy/policy/modules/system/domain.if @@ -120,11 +120,12 @@ define(`domain_all_init_domains_transition',` requires_block_template(domain_all_init_domains_transition_depend,$3) allow $1 init_domain:process transition; allow $1 init_domain_entry:file { getattr read execute }; +dontaudit $1 daemon_domain:process { noatsecure siginh rlimitinh }; ') define(`domain_all_init_domains_transition_depend',` attribute init_domain, init_domain_entry; -class process transition; +class process { transition noatsecure siginh rlimitinh }; class file { getattr read execute }; ') @@ -136,11 +137,13 @@ define(`domain_all_daemon_domains_transition',` requires_block_template(domain_all_daemon_domains_transition_depend,$3) allow $1 daemon_domain:process transition; allow $1 daemon_domain_entry:file { getattr read execute }; +allow init_domain $1:fd use; +dontaudit $1 daemon_domain:process { noatsecure siginh rlimitinh }; ') define(`domain_all_daemon_domains_transition_depend',` attribute daemon_domain, daemon_domain_entry; -class process transition; +class process { transition noatsecure siginh rlimitinh }; class file { getattr read execute }; ')