Fix mislabeling that occurs if and admin runs pm-utils directly

diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index c464d3b0fdbc36bfb07b529b8c4fb8c4cc8dec8c..850b350cbecb741f7d2cf6142de80dad3a8a94fe 100644 (file)
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -157,6 +157,10 @@ optional_policy(`
     daemonstools_run_start(sysadm_t, sysadm_r)
 ')
 
+optional_policy(`
+       dbus_role_template(sysadm, sysadm_r, sysadm_t)
+')
+
 optional_policy(`
        dcc_run_cdcc(sysadm_t, sysadm_r)
        dcc_run_client(sysadm_t, sysadm_r)
@@ -164,11 +168,11 @@ optional_policy(`
 ')
 
 optional_policy(`
-       dbus_role_template(sysadm, sysadm_r, sysadm_t)
+       ddcprobe_run(sysadm_t, sysadm_r)
 ')
 
 optional_policy(`
-       ddcprobe_run(sysadm_t, sysadm_r)
+       devicekit_filetrans_named_content(unconfined_usertype)
 ')
 
 optional_policy(`

diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
index 1105ff5733a5b473c8715c54b2b623ec13adaee1..fcc8949b72c6b5dc95c9facac9552c3b8a39384c 100644 (file)
--- a/policy/modules/roles/unconfineduser.te
+++ b/policy/modules/roles/unconfineduser.te
@@ -169,6 +169,7 @@ optional_policy(`
                devicekit_dbus_chat(unconfined_usertype)
                devicekit_dbus_chat_disk(unconfined_usertype)
                devicekit_dbus_chat_power(unconfined_usertype)
+               devicekit_filetrans_named_content(unconfined_usertype)
        ')
 
        optional_policy(`

diff --git a/policy/modules/services/devicekit.if b/policy/modules/services/devicekit.if
index 13d3a357a82436be7affbb80511fdc4064600eae..afb61c9c8f6a3493f50e1fd346743f067c87e295 100644 (file)
--- a/policy/modules/services/devicekit.if
+++ b/policy/modules/services/devicekit.if
@@ -326,3 +326,21 @@ interface(`devicekit_admin',`
        admin_pattern($1, devicekit_var_run_t)
        files_list_pids($1)
 ')
+
+########################################
+## <summary>
+##     Transition to devicekit named content
+## </summary>
+## <param name="domain">
+##     <summary>
+##      Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`devicekit_filetrans_named_content',`
+       gen_require(`
+               type devicekit_var_run_t;
+       ')
+
+       files_pid_filetrans($1, devicekit_var_run_t, dir, "pm-utils")
+')