Allow initrc_t to watch user terminals, needed for new systemd if a l…

…ogin process exits without relabelling the device Signed-off-by: Russell Coker <[email protected]>
SELinuxProject · Nov 25, 2023 · 06f9ce3 · 06f9ce3
1 parent 7396e53
commit 06f9ce3
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
@@ -1500,6 +1500,10 @@ optional_policy(`
 	rpm_delete_db(initrc_t)
 ')
 
+optional_policy(`
+	userdom_watch_user_ttys(initrc_t)
+')
+
 optional_policy(`
 	vmware_read_system_config(initrc_t)
 	vmware_append_system_config(initrc_t)

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
@@ -4162,6 +4162,24 @@ interface(`userdom_dontaudit_setattr_user_ttys',`
 	dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
 ')
 
+########################################
+## <summary>
+##	watch a user domain tty.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`userdom_watch_user_ttys',`
+	gen_require(`
+		type user_tty_device_t;
+	')
+
+	allow $1 user_tty_device_t:chr_file watch;
+')
+
 ########################################
 ## <summary>
 ##	Read and write a user domain tty.