crond_t wants to read init state, staff_t needs to be able to delete pulseaudio tmpfs...

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 9327832d321e3a2955ab9bf8e3561fdd2192baf3..7ccb554be6c13c636df053a7b8f9f639ddbb812d 100644 (file)
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -132,7 +132,7 @@ optional_policy(`
 
 optional_policy(`
        qemu_run(staff_t, staff_r)
-       virt_read_tmpfs_files(staff_t)
+       virt_manage_tmpfs_files(staff_t)
 ')
 
 optional_policy(`

diff --git a/policy/modules/services/cron.te b/policy/modules/services/cron.te
index 9941737dc77b85d18054aa107df49d457c9c134c..220ba1bc74b772b3e335ebc50f3e4e3bc45b6358 100644 (file)
--- a/policy/modules/services/cron.te
+++ b/policy/modules/services/cron.te
@@ -223,6 +223,7 @@ files_search_default(crond_t)
 fs_manage_cgroup_dirs(crond_t)
 fs_manage_cgroup_files(crond_t)
 
+init_read_state(crond_t)
 init_rw_utmp(crond_t)
 init_spec_domtrans_script(crond_t)