From c19e4cb9a3f23f2b14c31c978627f9c486a369f4 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Wed, 31 Aug 2022 18:20:03 +0200 Subject: [PATCH] Allow systemd permissions needed for sandboxed services The permissions to mounton self and get mail spool files attributes were added for init_t. Example service requiring them is accounts-daemon from the accountsservice package which since v22 has more tightened sandboxing, including mounting into private namespaces and listing accessible paths. Resolves: rhbz#2122059 --- policy/modules/system/init.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 06be25304a..4311dbc359 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -187,6 +187,7 @@ allow init_t self:bpf { map_create map_read map_write prog_load prog_run }; # setuid (from /sbin/shutdown) # sys_chroot (from /usr/bin/chroot): now provided by corecmd_chroot_exec_chroot() +allow init_t self:file mounton; allow init_t self:fifo_file rw_fifo_file_perms; allow init_t self:service manage_service_perms; @@ -544,6 +545,7 @@ optional_policy(` optional_policy(` postfix_exec(init_t) postfix_list_spool(init_t) + mta_getattr_spool(init_t) mta_read_config(init_t) mta_manage_aliases(init_t) ')