65e1b35102
When osbuild is invoked via the osbuild composer worker, the latter is run in the unconfined_service_t domain, so add a rule that allows that transition.
66 lines
1.4 KiB
Text
66 lines
1.4 KiB
Text
policy_module(osbuild, 1.0.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
attribute_role osbuild_roles;
|
|
roleattribute system_r osbuild_roles;
|
|
|
|
type osbuild_t;
|
|
type osbuild_exec_t;
|
|
application_domain(osbuild_t, osbuild_exec_t)
|
|
role osbuild_roles types osbuild_t;
|
|
|
|
########################################
|
|
#
|
|
# osbuild local policy
|
|
#
|
|
|
|
allow osbuild_t self:fifo_file manage_fifo_file_perms;
|
|
allow osbuild_t self:unix_stream_socket create_stream_socket_perms;
|
|
|
|
# #####################################
|
|
# Customization
|
|
#
|
|
|
|
# make an osbuild_t unconfined domain
|
|
unconfined_domain(osbuild_t)
|
|
|
|
# execute setfiles in the setfiles_mac domain
|
|
# when in the osbuild_t domain
|
|
seutil_domtrans_setfiles_mac(osbuild_t)
|
|
|
|
# Allow sysadm and unconfined to run osbuild
|
|
optional_policy(`
|
|
gen_require(`
|
|
type sysadm_t;
|
|
role sysadm_r;
|
|
')
|
|
|
|
osbuild_run(sysadm_t, sysadm_r)
|
|
')
|
|
|
|
optional_policy(`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
role unconfined_r;
|
|
')
|
|
|
|
osbuild_run(unconfined_t, unconfined_r)
|
|
')
|
|
|
|
optional_policy(`
|
|
gen_require(`
|
|
type unconfined_service_t;
|
|
role system_r;
|
|
')
|
|
|
|
osbuild_run(unconfined_service_t, system_r)
|
|
')
|
|
|
|
# allow transitioning to install_t (for ostree)
|
|
optional_policy(`
|
|
anaconda_domtrans_install(osbuild_t)
|
|
')
|