diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index d2c0219b62..c832bffe8f 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -572,6 +572,7 @@ optional_policy(` systemd_allow_create_mount_dir(init_t) systemd_hostnamed_delete_config(init_t) systemd_manage_conf_files(init_t) + systemd_rw_networkd_tmpfs_files(init_t) ') optional_policy(` diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if index 20363fa30d..df57f42283 100644 --- a/policy/modules/system/systemd.if +++ b/policy/modules/system/systemd.if @@ -2734,6 +2734,24 @@ interface(`systemd_networkd_watch_pid_dirs',` allow $1 systemd_networkd_var_run_t:dir watch_dir_perms; ') +######################################## +## +## Read and write to systemd-networkd tmpfs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`systemd_rw_networkd_tmpfs_files',` + gen_require(` + type systemd_networkd_tmpfs_t; + ') + + allow $1 systemd_networkd_tmpfs_t:file rw_file_perms; +') + ######################################## ## ## Mmap systemd_resolved_exec_t files. diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index 9189e167c0..27e5ee6fd1 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -76,6 +76,9 @@ systemd_unit_file(systemd_hwdb_unit_file_t) systemd_domain_template(systemd_networkd) init_nnp_daemon_domain(systemd_networkd_t) +type systemd_networkd_tmpfs_t; +files_tmpfs_file(systemd_networkd_tmpfs_t) + type systemd_networkd_unit_file_t; systemd_unit_file(systemd_networkd_unit_file_t) @@ -609,6 +612,9 @@ allow init_t systemd_networkd_t:netlink_route_socket create_netlink_socket_perms allow systemd_networkd_t systemd_networkd_var_lib_t:dir list_dir_perms; create_files_pattern(systemd_networkd_t, systemd_networkd_var_lib_t, systemd_networkd_var_lib_t) +manage_files_pattern(systemd_networkd_t, systemd_networkd_tmpfs_t, systemd_networkd_tmpfs_t) +fs_tmpfs_filetrans(systemd_networkd_t, systemd_networkd_tmpfs_t, file) + manage_files_pattern(systemd_networkd_t, systemd_networkd_var_run_t, systemd_networkd_var_run_t) manage_lnk_files_pattern(systemd_networkd_t, systemd_networkd_var_run_t, systemd_networkd_var_run_t) manage_sock_files_pattern(systemd_networkd_t, systemd_networkd_var_run_t, systemd_networkd_var_run_t)