[PATCH 03/10] Allow colord_t to exec colord_exec_t type
Laurent Bigonville <[email protected]>
| Newsgroups | org.kernel.vger.selinux-refpolicy |
|---|---|
| Message-ID | <[email protected]> |
From: Laurent Bigonville <[email protected]> The main colord daemon can exec other daemon like colord-sane type=AVC msg=audit(04/10/19 10:12:46.339:1676) : avc: denied { execute_no_trans } for pid=16983 comm=colord path=/usr/lib/colord/colord-sane dev="dm-1" ino=1049183 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:colord_exec_t:s0 tclass=file permissive=1 Signed-off-by: Laurent Bigonville <[email protected]> --- policy/modules/services/colord.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/services/colord.te b/policy/modules/services/colord.te index 6117b06f..fada3fb8 100644 --- a/policy/modules/services/colord.te +++ b/policy/modules/services/colord.te @@ -43,6 +43,8 @@ manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t) manage_files_pattern(colord_t, colord_var_lib_t, colord_var_lib_t) files_var_lib_filetrans(colord_t, colord_var_lib_t, dir) +can_exec(colord_t, colord_exec_t) + kernel_read_crypto_sysctls(colord_t) kernel_read_device_sysctls(colord_t) kernel_read_network_state(colord_t) -- 2.23.0