mirror of
git://git.yoctoproject.org/meta-selinux
synced 2026-01-01 13:58:04 +00:00
32adf788c7
* 5a6c7d8bf systemd: Add log env to systemd-machine-id-setup. * 33af8dfa4 Module for ipmitool * a3a6b1704 oddjob: allow oddjob_mkhomedir_t privfd:fd use * 621eb6caf systemd: allow reading /dev/cpu/0/msr * fb0e9cdda Remove unneeded backticks from gen_tunable * 2240e1a89 locallogin: allow sulogin_t user_tty_device_t rw Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
68 lines
2.2 KiB
Diff
68 lines
2.2 KiB
Diff
From abcc9a219a57c4cdc60f72cd91372204f3fcfa38 Mon Sep 17 00:00:00 2001
|
|
From: Joe MacDonald <joe_macdonald@mentor.com>
|
|
Date: Fri, 5 Apr 2019 11:53:28 -0400
|
|
Subject: [PATCH] refpolicy-minimum: make sysadmin module optional
|
|
|
|
The init and locallogin modules have a depend for sysadm module
|
|
because they have called sysadm interfaces(sysadm_shell_domtrans).
|
|
Since sysadm is not a core module, we could make the
|
|
sysadm_shell_domtrans calls optionally by optional_policy.
|
|
|
|
So, we could make the minimum policy without sysadm module.
|
|
|
|
Upstream-Status: Inappropriate [embedded specific]
|
|
|
|
Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
|
|
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
|
|
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
|
|
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
|
|
---
|
|
policy/modules/system/init.te | 14 ++++++++------
|
|
policy/modules/system/locallogin.te | 4 +++-
|
|
2 files changed, 11 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
|
|
index bde3d5944..cff62daa0 100644
|
|
--- a/policy/modules/system/init.te
|
|
+++ b/policy/modules/system/init.te
|
|
@@ -653,13 +653,15 @@ ifdef(`init_systemd',`
|
|
unconfined_write_keys(init_t)
|
|
')
|
|
',`
|
|
- tunable_policy(`init_upstart',`
|
|
- corecmd_shell_domtrans(init_t, initrc_t)
|
|
+ optional_policy(`
|
|
+ tunable_policy(`init_upstart',`
|
|
+ corecmd_shell_domtrans(init_t, initrc_t)
|
|
',`
|
|
- # Run the shell in the sysadm role for single-user mode.
|
|
- # causes problems with upstart
|
|
- ifndef(`distro_debian',`
|
|
- sysadm_shell_domtrans(init_t)
|
|
+ # Run the shell in the sysadm role for single-user mode.
|
|
+ # causes problems with upstart
|
|
+ ifndef(`distro_debian',`
|
|
+ sysadm_shell_domtrans(init_t)
|
|
+ ')
|
|
')
|
|
')
|
|
')
|
|
diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
|
|
index 59bcc78c8..f25168e3b 100644
|
|
--- a/policy/modules/system/locallogin.te
|
|
+++ b/policy/modules/system/locallogin.te
|
|
@@ -280,7 +280,9 @@ userdom_use_unpriv_users_fds(sulogin_t)
|
|
userdom_search_user_home_dirs(sulogin_t)
|
|
userdom_use_user_terminals(sulogin_t)
|
|
|
|
-sysadm_shell_domtrans(sulogin_t)
|
|
+optional_policy(`
|
|
+ sysadm_shell_domtrans(sulogin_t)
|
|
+')
|
|
|
|
# by default, sulogin does not use pam...
|
|
# sulogin_pam might need to be defined otherwise
|
|
--
|
|
2.25.1
|
|
|