me/guix
Archived
1
0
Fork 0
Code Activity

etc: Add more SELinux permissions for the daemon.

Browse source 
* etc/guix-daemon.cil.in (guix_daemon): Permit file appending, setattr,
read/write UDP sockets, access to tmpfs and hugetlbfs, and connecting to
PostgreSQL.
This commit is contained in:
Marius Bakke 2020-11-26 00:29:53 +01:00
parent 9b9c6f2594
commit 402ebffe19
No known key found for this signature in database
GPG key ID: A2A06DF2A33A54FA
1 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
etc/guix-daemon.cil.in
View file

@ -264,6 +264,7 @@
link unlink link unlink
map map
rename rename
append
open read write relabelfrom))) open read write relabelfrom)))
(allow guix_daemon_t (allow guix_daemon_t
guix_store_content_t guix_store_content_t
@ -277,7 +278,7 @@
(fifo_file (create getattr open read unlink write))) (fifo_file (create getattr open read unlink write)))
(allow guix_daemon_t (allow guix_daemon_t
guix_store_content_t guix_store_content_t
(sock_file (create getattr unlink write))) (sock_file (create getattr setattr unlink write)))
;; Access to configuration files and directories ;; Access to configuration files and directories
(allow guix_daemon_t (allow guix_daemon_t
@ -362,7 +363,7 @@
(tcp_socket (name_bind name_connect accept listen))) (tcp_socket (name_bind name_connect accept listen)))
(allow guix_daemon_t (allow guix_daemon_t
self self
(udp_socket (connect getattr bind getopt setopt))) (udp_socket (connect getattr bind getopt setopt read write)))
(allow guix_daemon_t (allow guix_daemon_t
self self
(fifo_file (write read))) (fifo_file (write read)))
@ -376,6 +377,7 @@
self self
(unix_dgram_socket (create bind connect sendto read write))) (unix_dgram_socket (create bind connect sendto read write)))
;; For some esoteric build jobs (i.e. PostgreSQL).
(allow guix_daemon_t (allow guix_daemon_t
node_t node_t
(tcp_socket (node_bind))) (tcp_socket (node_bind)))
@ -385,6 +387,15 @@
(allow guix_daemon_t (allow guix_daemon_t
port_t port_t
(tcp_socket (name_connect))) (tcp_socket (name_connect)))
(allow guix_daemon_t
tmpfs_t
(file (map read write)))
(allow guix_daemon_t
hugetlbfs_t
(file (map read write)))
(allow guix_daemon_t
postgresql_port_t
(tcp_socket (name_connect name_bind)))
(allow guix_daemon_t (allow guix_daemon_t
rtp_media_port_t rtp_media_port_t
(udp_socket (name_bind))) (udp_socket (name_bind)))