Blame fapolicyd-selinux-allow-boot-home.patch

2a4ad6e
From a1a9a59f93ebfe6d0c9d725ed0712210994e6d64 Mon Sep 17 00:00:00 2001
2a4ad6e
From: Zdenek Pytela <zpytela@redhat.com>
2a4ad6e
Date: Tue, 6 Apr 2021 16:06:48 +0200
2a4ad6e
Subject: [PATCH] Allow fapolicyd watch boot and home directories
2a4ad6e
2a4ad6e
The fapolicyd service needs watch_mount and watch_with_perm permissions
2a4ad6e
for fanotify/inotify/dnotify calls on the following directories:
2a4ad6e
- /boot and /boot/efi directories
2a4ad6e
- /home directories
2a4ad6e
2a4ad6e
Note the /boot/efi directory has the dosfs_t label.
2a4ad6e
---
2a4ad6e
 fapolicyd.te | 6 ++++++
2a4ad6e
 1 file changed, 6 insertions(+)
2a4ad6e
2a4ad6e
diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te
2a4ad6e
index f5d0052..c12f385 100644
2a4ad6e
--- a/fapolicyd-selinux-0.4/fapolicyd.te
2a4ad6e
+++ b/fapolicyd-selinux-0.4/fapolicyd.te
2a4ad6e
@@ -63,14 +63,20 @@ domain_read_all_domains_state(fapolicyd_t)
2a4ad6e
 
2a4ad6e
 files_mmap_usr_files(fapolicyd_t)
2a4ad6e
 files_read_all_files(fapolicyd_t)
2a4ad6e
+files_watch_mount_boot_dirs(fapolicyd_t)
2a4ad6e
+files_watch_with_perm_boot_dirs(fapolicyd_t)
2a4ad6e
 files_watch_mount_generic_tmp_dirs(fapolicyd_t)
2a4ad6e
 files_watch_with_perm_generic_tmp_dirs(fapolicyd_t)
2a4ad6e
+files_watch_mount_home(fapolicyd_t)
2a4ad6e
+files_watch_with_perm_home(fapolicyd_t)
2a4ad6e
 files_watch_mount_root_dirs(fapolicyd_t)
2a4ad6e
 files_watch_with_perm_root_dirs(fapolicyd_t)
2a4ad6e
 
2a4ad6e
 fs_getattr_xattr_fs(fapolicyd_t)
2a4ad6e
 fs_watch_mount_tmpfs_dirs(fapolicyd_t)
2a4ad6e
 fs_watch_with_perm_tmpfs_dirs(fapolicyd_t)
2a4ad6e
+fs_watch_mount_dos_dirs(fapolicyd_t)
2a4ad6e
+fs_watch_with_perm_dos_dirs(fapolicyd_t)
2a4ad6e
 
2a4ad6e
 logging_send_syslog_msg(fapolicyd_t)
2a4ad6e
 dbus_system_bus_client(fapolicyd_t)