diff options
| author |   Chris PeBenito <Christopher.PeBenito@microsoft.com> | 2023-02-09 19:42:55 +0000 |
|---|---|---|
| committer |   Kenton Groombridge <concord@gentoo.org> | 2024-03-01 12:05:26 -0500 |
| commit | 48e4c66c337218f3b8372ed407144905bfe437e7 (patch) | |
| tree | 3180bfea4452c0bfeabeab8399a8dc4f572e6d48 | |
| parent | cloud-init: Allow use of sudo in runcmd. (diff) | |
| download | hardened-refpolicy-48e4c66c337218f3b8372ed407144905bfe437e7.tar.gz hardened-refpolicy-48e4c66c337218f3b8372ed407144905bfe437e7.tar.bz2 hardened-refpolicy-48e4c66c337218f3b8372ed407144905bfe437e7.zip | |
cloud-init: Add systemd permissions.
Additional access for controlling systemd units and logind dbus chat.
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
| -rw-r--r-- | policy/modules/admin/cloudinit.te | 12 | ||||
| -rw-r--r-- | policy/modules/system/init.if | 19 |
2 files changed, 27 insertions, 4 deletions
diff --git a/policy/modules/admin/cloudinit.te b/policy/modules/admin/cloudinit.te index ec0db320..6ae0bf99 100644 --- a/policy/modules/admin/cloudinit.te +++ b/policy/modules/admin/cloudinit.te @@ -75,10 +75,6 @@ fstools_domtrans(cloud_init_t) hostname_domtrans(cloud_init_t) -init_get_system_status(cloud_init_t) -init_read_state(cloud_init_t) -init_stream_connect(cloud_init_t) - kernel_read_system_state(cloud_init_t) kernel_read_kernel_sysctls(cloud_init_t) @@ -129,5 +125,13 @@ optional_policy(` ') optional_policy(` + init_get_system_status(cloud_init_t) + init_start_all_units(cloud_init_t) + init_stop_all_units(cloud_init_t) + init_get_all_units_status(cloud_init_t) + init_list_all_units(cloud_init_t) + + systemd_exec_systemctl(cloud_init_t) systemd_dbus_chat_hostnamed(cloud_init_t) + systemd_dbus_chat_logind(cloud_init_t) ') diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if index 197836cf..44e3fcc2 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -3841,6 +3841,25 @@ interface(`init_reload_all_units',` ######################################## ## <summary> +## List systemd unit dirs and the files in them +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`init_list_all_units',` + gen_require(` + attribute systemdunit; + ') + + list_dirs_pattern($1, systemdunit, systemdunit) + read_lnk_files_pattern($1, systemdunit, systemdunit) +') + +######################################## +## <summary> ## Manage systemd unit dirs and the files in them ## </summary> ## <param name="domain"> |