Update sponson selinux and add systemdmachine patch
parent
9d535dfaaf
commit
5650ba5548
Binary file not shown.
Binary file not shown.
@ -0,0 +1,42 @@
|
||||
|
||||
module systemdmachine 1.0;
|
||||
|
||||
require {
|
||||
type tmpfs_t;
|
||||
type devpts_t;
|
||||
type systemd_machined_t;
|
||||
type systemd_unit_file_t;
|
||||
type var_lib_t;
|
||||
type unconfined_service_t;
|
||||
class dir search;
|
||||
class process signal;
|
||||
class lnk_file read;
|
||||
class cap_userns { kill sys_admin sys_ptrace };
|
||||
class chr_file open;
|
||||
class file { getattr open read };
|
||||
class sock_file write;
|
||||
class service stop;
|
||||
}
|
||||
|
||||
#============= systemd_machined_t ==============
|
||||
|
||||
allow systemd_machined_t devpts_t:chr_file open;
|
||||
|
||||
allow systemd_machined_t self:cap_userns { kill sys_admin sys_ptrace };
|
||||
|
||||
allow systemd_machined_t tmpfs_t:lnk_file read;
|
||||
|
||||
allow systemd_machined_t tmpfs_t:sock_file write;
|
||||
|
||||
allow systemd_machined_t unconfined_service_t:dir search;
|
||||
|
||||
allow systemd_machined_t unconfined_service_t:file { getattr open read };
|
||||
|
||||
allow systemd_machined_t unconfined_service_t:lnk_file read;
|
||||
|
||||
allow systemd_machined_t unconfined_service_t:process signal;
|
||||
|
||||
allow systemd_machined_t var_lib_t:lnk_file read;
|
||||
|
||||
allow systemd_machined_t systemd_unit_file_t:service stop;
|
||||
|
Loading…
Reference in New Issue