parent
9d535dfaaf
commit
5650ba5548
Binary file not shown.
Binary file not shown.
@ -0,0 +1,42 @@ |
||||
|
||||
module systemdmachine 1.0; |
||||
|
||||
require { |
||||
type tmpfs_t; |
||||
type devpts_t; |
||||
type systemd_machined_t; |
||||
type systemd_unit_file_t; |
||||
type var_lib_t; |
||||
type unconfined_service_t; |
||||
class dir search; |
||||
class process signal; |
||||
class lnk_file read; |
||||
class cap_userns { kill sys_admin sys_ptrace }; |
||||
class chr_file open; |
||||
class file { getattr open read }; |
||||
class sock_file write; |
||||
class service stop; |
||||
} |
||||
|
||||
#============= systemd_machined_t ============== |
||||
|
||||
allow systemd_machined_t devpts_t:chr_file open; |
||||
|
||||
allow systemd_machined_t self:cap_userns { kill sys_admin sys_ptrace }; |
||||
|
||||
allow systemd_machined_t tmpfs_t:lnk_file read; |
||||
|
||||
allow systemd_machined_t tmpfs_t:sock_file write; |
||||
|
||||
allow systemd_machined_t unconfined_service_t:dir search; |
||||
|
||||
allow systemd_machined_t unconfined_service_t:file { getattr open read }; |
||||
|
||||
allow systemd_machined_t unconfined_service_t:lnk_file read; |
||||
|
||||
allow systemd_machined_t unconfined_service_t:process signal; |
||||
|
||||
allow systemd_machined_t var_lib_t:lnk_file read; |
||||
|
||||
allow systemd_machined_t systemd_unit_file_t:service stop; |
||||
|
Loading…
Reference in new issue