aboutsummaryrefslogtreecommitdiff
path: root/etc
diff options
context:
space:
mode:
authorRicardo Wurmus <rekado@elephly.net>2022-12-23 16:47:11 +0100
committerRicardo Wurmus <rekado@elephly.net>2022-12-23 20:20:06 +0100
commit4a134ed32e69ba888d988d2ed924a1531a54551b (patch)
tree853f610ce4a90b0c49999d58aa39ab88f1523763 /etc
parentf28d792719abb82cc920486e6d6f14eacc44370c (diff)
downloadguix-4a134ed32e69ba888d988d2ed924a1531a54551b.tar
guix-4a134ed32e69ba888d988d2ed924a1531a54551b.tar.gz
etc: SELinux: Allow daemon to search run state directories.
* etc/guix-daemon.cil.in: Import types init_var_run_t and system_dbusd_var_run_t; add rules.
Diffstat (limited to 'etc')
-rw-r--r--etc/guix-daemon.cil.in16
1 files changed, 13 insertions, 3 deletions
diff --git a/etc/guix-daemon.cil.in b/etc/guix-daemon.cil.in
index ba100a4535..0245c36231 100644
--- a/etc/guix-daemon.cil.in
+++ b/etc/guix-daemon.cil.in
@@ -1,6 +1,6 @@
; -*- lisp -*-
;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2018, 2022 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2020 Daniel Brooks <db48x@db48x.net>
;;; Copyright © 2020 Marius Bakke <marius@gnu.org>
;;;
@@ -37,11 +37,13 @@
(block guix_daemon
;; Require existing types
+ (typeattributeset cil_gen_require domain)
(typeattributeset cil_gen_require init_t)
- (typeattributeset cil_gen_require tmp_t)
+ (typeattributeset cil_gen_require init_var_run_t)
(typeattributeset cil_gen_require nscd_var_run_t)
+ (typeattributeset cil_gen_require system_dbusd_var_run_t)
+ (typeattributeset cil_gen_require tmp_t)
(typeattributeset cil_gen_require var_log_t)
- (typeattributeset cil_gen_require domain)
;; Declare own types
(type guix_daemon_t)
@@ -284,6 +286,14 @@
guix_store_content_t
(sock_file (create getattr setattr unlink write)))
+ ;; Access to run state directories
+ (allow guix_daemon_t
+ system_dbusd_var_run_t
+ (dir (search)))
+ (allow guix_daemon_t
+ init_var_run_t
+ (dir (search)))
+
;; Access to configuration files and directories
(allow guix_daemon_t
guix_daemon_conf_t