me/guix
Archived
1
0
Fork 0
Code Activity

etc: SELinux: Allow daemon to search run state directories.

Browse source 
* etc/guix-daemon.cil.in: Import types init_var_run_t and
system_dbusd_var_run_t; add rules.
This commit is contained in:
Ricardo Wurmus 2022-12-23 16:47:11 +01:00
parent f28d792719
commit 4a134ed32e
No known key found for this signature in database
GPG key ID: 197A5888235FACAC
1 changed files with 15 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
etc/guix-daemon.cil.in
View file

@ -1,6 +1,6 @@
; -*- lisp -*- ; -*- lisp -*-
;;; GNU Guix --- Functional package management for GNU ;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net> ;;; Copyright © 2018, 2022 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2020 Daniel Brooks <db48x@db48x.net> ;;; Copyright © 2020 Daniel Brooks <db48x@db48x.net>
;;; Copyright © 2020 Marius Bakke <marius@gnu.org> ;;; Copyright © 2020 Marius Bakke <marius@gnu.org>
;;; ;;;
@ -37,11 +37,13 @@
(block guix_daemon (block guix_daemon
;; Require existing types ;; Require existing types
(typeattributeset cil_gen_require init_t)
(typeattributeset cil_gen_require tmp_t)
(typeattributeset cil_gen_require nscd_var_run_t)
(typeattributeset cil_gen_require var_log_t)
(typeattributeset cil_gen_require domain) (typeattributeset cil_gen_require domain)
(typeattributeset cil_gen_require init_t)
(typeattributeset cil_gen_require init_var_run_t)
(typeattributeset cil_gen_require nscd_var_run_t)
(typeattributeset cil_gen_require system_dbusd_var_run_t)
(typeattributeset cil_gen_require tmp_t)
(typeattributeset cil_gen_require var_log_t)
;; Declare own types ;; Declare own types
(type guix_daemon_t) (type guix_daemon_t)
@ -284,6 +286,14 @@
guix_store_content_t guix_store_content_t
(sock_file (create getattr setattr unlink write))) (sock_file (create getattr setattr unlink write)))
;; Access to run state directories
(allow guix_daemon_t
system_dbusd_var_run_t
(dir (search)))
(allow guix_daemon_t
init_var_run_t
(dir (search)))
;; Access to configuration files and directories ;; Access to configuration files and directories
(allow guix_daemon_t (allow guix_daemon_t
guix_daemon_conf_t guix_daemon_conf_t