Blame fapolicyd-selinux-watch-perm.patch

2a4ad6e
From 6a966a3ee89233a0a055712f39ca564ba91183bf Mon Sep 17 00:00:00 2001
2a4ad6e
From: Zdenek Pytela <zpytela@redhat.com>
2a4ad6e
Date: Thu, 15 Apr 2021 16:56:08 +0200
2a4ad6e
Subject: [PATCH] Allow fapolicyd watch_mount/watch_with_perm all files and
2a4ad6e
 directories
2a4ad6e
2a4ad6e
For the fanotify_mark() syscall, fapolicyd uses the FAN_MARK_MOUNT flag
2a4ad6e
to mark the file's mount point to monitor. As this can be any file or
2a4ad6e
directory on the filesystem, the SELinux watch_mount and watch_with_perm
2a4ad6e
permissions are allowed for the file_type attribute.
2a4ad6e
---
2a4ad6e
 fapolicyd.te | 6 ++++++
2a4ad6e
 1 file changed, 6 insertions(+)
2a4ad6e
2a4ad6e
diff --git a/fapolicyd-selinux-0.4/fapolicyd.te b/fapolicyd-selinux-0.4/fapolicyd.te
2a4ad6e
index c12f385..582e03f 100644
2a4ad6e
--- a/fapolicyd-selinux-0.4/fapolicyd.te
2a4ad6e
+++ b/fapolicyd-selinux-0.4/fapolicyd.te
2a4ad6e
@@ -36,6 +36,12 @@ allow fapolicyd_t self:process { setcap setsched };
2a4ad6e
 allow fapolicyd_t self:unix_stream_socket create_stream_socket_perms;
2a4ad6e
 allow fapolicyd_t self:unix_dgram_socket create_socket_perms;
2a4ad6e
 
2a4ad6e
+gen_require(`
2a4ad6e
+	attribute file_type;
2a4ad6e
+')
2a4ad6e
+allow fapolicyd_t file_type:dir { watch_mount watch_with_perm };
2a4ad6e
+allow fapolicyd_t file_type:file { watch_mount watch_with_perm };
2a4ad6e
+
2a4ad6e
 manage_files_pattern(fapolicyd_t, fapolicyd_log_t, fapolicyd_log_t)
2a4ad6e
 logging_log_filetrans(fapolicyd_t, fapolicyd_log_t, file)
2a4ad6e