diff --git a/policy/modules/system/raid.fc b/policy/modules/system/raid.fc index 1eed007..42d3890 100644 --- a/policy/modules/system/raid.fc +++ b/policy/modules/system/raid.fc @@ -1,4 +1,4 @@ -/dev/.mdadm\.map -- gen_context(system_u:object_r:mdadm_map_t,s0) +/dev/.mdadm\.map -- gen_context(system_u:object_r:mdadm_var_run_t,s0) /dev/md(/.*)? gen_context(system_u:object_r:mdadm_var_run_t,s0) /sbin/mdadm -- gen_context(system_u:object_r:mdadm_exec_t,s0) diff --git a/policy/modules/system/raid.te b/policy/modules/system/raid.te index afb14e9..6500830 100644 --- a/policy/modules/system/raid.te +++ b/policy/modules/system/raid.te @@ -10,10 +10,7 @@ type mdadm_exec_t; init_daemon_domain(mdadm_t, mdadm_exec_t) role system_r types mdadm_t; -type mdadm_map_t; -files_type(mdadm_map_t) - -type mdadm_var_run_t; +type mdadm_var_run_t alias mdadm_map_t; files_pid_file(mdadm_var_run_t) dev_associate(mdadm_var_run_t) @@ -27,10 +24,6 @@ dontaudit mdadm_t self:capability sys_tty_config; allow mdadm_t self:process { sigchld sigkill sigstop signull signal }; allow mdadm_t self:fifo_file rw_fifo_file_perms; -# create .mdadm files in /dev -allow mdadm_t mdadm_map_t:file manage_file_perms; -dev_filetrans(mdadm_t, mdadm_map_t, file) - manage_dirs_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t) manage_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t) manage_sock_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)