All spoolfile attribute so that systemd can create and delete sockets in spool file...

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index c0e0b1e13b7bb52a35e13b9d5051a7d9a6c4dd11..d6ca227e548f91465f56d630075560c812ece5a0 100644 (file)
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -55,6 +55,7 @@
 ##             <li>files_pid_file()</li>
 ##             <li>files_security_file()</li>
 ##             <li>files_security_mountpoint()</li>
+##             <li>files_spool_file()</li>
 ##             <li>files_tmp_file()</li>
 ##             <li>files_tmpfs_file()</li>
 ##             <li>logging_log_file()</li>
@@ -6378,6 +6379,90 @@ interface(`files_delete_all_pid_dirs',`
        delete_dirs_pattern($1, pidfile, pidfile)
 ')
 
+########################################
+## <summary>
+##     Make the specified type a file
+##     used for spool files.
+## </summary>
+## <desc>
+##     <p>
+##     Make the specified type usable for spool files.
+##     This will also make the type usable for files, making
+##     calls to files_type() redundant.  Failure to use this interface
+##     for a spool file may result in problems with
+##     purging spool files.
+##     </p>
+##     <p>
+##     Related interfaces:
+##     </p>
+##     <ul>
+##             <li>files_spool_filetrans()</li>
+##     </ul>
+##     <p>
+##     Example usage with a domain that can create and
+##     write its spool file in the system spool file
+##     directories (/var/spool):
+##     </p>
+##     <p>
+##     type myspoolfile_t;
+##     files_spool_file(myfile_spool_t)
+##     allow mydomain_t myfile_spool_t:file { create_file_perms write_file_perms };
+##     files_spool_filetrans(mydomain_t, myfile_spool_t, file)
+##     </p>
+## </desc>
+## <param name="file_type">
+##     <summary>
+##     Type of the file to be used as a
+##     spool file.
+##     </summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`files_spool_file',`
+       gen_require(`
+               attribute spoolfile;
+       ')
+
+       files_type($1)
+       typeattribute $1 spoolfile;
+')
+
+########################################
+## <summary>
+##     Create all spool sockets
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`files_create_all_spool_sockets',`
+       gen_require(`
+               attribute spoolfile;
+       ')
+
+       allow $1 spoolfile:sock_file create_sock_file_perms;
+')
+
+########################################
+## <summary>
+##     Delete all spool sockets
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`files_delete_all_spool_sockets',`
+       gen_require(`
+               attribute spoolfile;
+       ')
+
+       allow $1 spoolfile:sock_file delete_sock_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     Search the contents of generic spool

diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te
index 567322bacc14d3f7baaff5c017f6b7956520ac89..20251b0d775438aa989b5b5dec3798aff02ce1f7 100644 (file)
--- a/policy/modules/kernel/files.te
+++ b/policy/modules/kernel/files.te
@@ -10,6 +10,7 @@ attribute files_unconfined_type;
 attribute lockfile;
 attribute mountpoint;
 attribute pidfile;
+attribute spoolfile;
 attribute configfile;
 attribute etcfile;
 
@@ -192,6 +193,7 @@ files_mountpoint(var_run_t)
 #
 type var_spool_t;
 files_tmp_file(var_spool_t)
+files_spool_file(var_spool_t)
 
 ########################################
 #

diff --git a/policy/modules/services/abrt.te b/policy/modules/services/abrt.te
index ffe6d415d7d6900de2c0d822fbfceabe4c9a2d6c..baad5e7047f759896de3c789dc9c0affcd4c1b1b 100644 (file)
--- a/policy/modules/services/abrt.te
+++ b/policy/modules/services/abrt.te
@@ -72,7 +72,7 @@ type abrt_retrace_cache_t;
 files_type(abrt_retrace_cache_t)
 
 type abrt_retrace_spool_t;
-files_type(abrt_retrace_spool_t)
+files_spool_file(abrt_retrace_spool_t)
 
 ########################################
 #

diff --git a/policy/modules/services/amavis.te b/policy/modules/services/amavis.te
index 4556eb2737df6668b4ccbfe29b56812af3f0845f..ae8c5791773b0b3a65f317f63f90260b3cc0eede 100644 (file)
--- a/policy/modules/services/amavis.te
+++ b/policy/modules/services/amavis.te
@@ -38,7 +38,7 @@ type amavis_quarantine_t;
 files_type(amavis_quarantine_t)
 
 type amavis_spool_t;
-files_type(amavis_spool_t)
+files_spool_file(amavis_spool_t)
 
 ########################################
 #

diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
index a079c51968792721ab100c669e7ec47279735881..edeae62c57818be447a04546d78941353e25cbcd 100644 (file)
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -340,6 +340,7 @@ typealias httpd_var_run_t alias httpd_fastcgi_var_run_t;
 # File Type of squirrelmail attachments
 type squirrelmail_spool_t;
 files_tmp_file(squirrelmail_spool_t)
+files_spool_file(squirrelmail_spool_t)
 
 optional_policy(`
        prelink_object_file(httpd_modules_t)

diff --git a/policy/modules/services/asterisk.te b/policy/modules/services/asterisk.te
index 0e8a352da1b9c6d07e251cb328f9da1df9a62f3c..c873197c2bd730bd0c075e48f384b5a42744c81b 100644 (file)
--- a/policy/modules/services/asterisk.te
+++ b/policy/modules/services/asterisk.te
@@ -19,7 +19,7 @@ type asterisk_log_t;
 logging_log_file(asterisk_log_t)
 
 type asterisk_spool_t;
-files_type(asterisk_spool_t)
+files_spool_file(asterisk_spool_t)
 
 type asterisk_tmp_t;
 files_tmp_file(asterisk_tmp_t)

diff --git a/policy/modules/services/callweaver.te b/policy/modules/services/callweaver.te
index a67f73259da948cd8e2b317edba4949ac720224a..a7c96a522c539624507531e74c05db375b82ca04 100644 (file)
--- a/policy/modules/services/callweaver.te
+++ b/policy/modules/services/callweaver.te
@@ -24,7 +24,7 @@ type callweaver_var_run_t;
 files_pid_file(callweaver_var_run_t)
 
 type callweaver_spool_t;
-files_type(callweaver_spool_t)
+files_spool_file(callweaver_spool_t)
 
 ########################################
 #

diff --git a/policy/modules/services/courier.te b/policy/modules/services/courier.te
index 452741cd61f49005f70580387b655cf8355bd226..59d0f964e6cd752253d8511d25a8d4f4e4370bd7 100644 (file)
--- a/policy/modules/services/courier.te
+++ b/policy/modules/services/courier.te
@@ -15,7 +15,7 @@ courier_domain_template(pcp)
 courier_domain_template(pop)
 
 type courier_spool_t;
-files_type(courier_spool_t)
+files_spool_file(courier_spool_t)
 
 courier_domain_template(tcpd)
 

diff --git a/policy/modules/services/cron.te b/policy/modules/services/cron.te
index 181256347bfbcdce76fbb23be4fb66f3e0985fe7..894130f48102f0059dd0c300f6250dbcd1251cf1 100644 (file)
--- a/policy/modules/services/cron.te
+++ b/policy/modules/services/cron.te
@@ -31,7 +31,7 @@ type anacron_exec_t;
 application_executable_file(anacron_exec_t)
 
 type cron_spool_t;
-files_type(cron_spool_t)
+files_spool_file(cron_spool_t)
 
 # var/lib files
 type cron_var_lib_t;
@@ -85,7 +85,7 @@ typealias crontab_tmp_t alias { auditadm_crontab_tmp_t secadm_crontab_tmp_t };
 allow admin_crontab_t crond_t:process signal;
 
 type system_cron_spool_t, cron_spool_type;
-files_type(system_cron_spool_t)
+files_spool_file(system_cron_spool_t)
 
 type system_cronjob_t alias system_crond_t;
 init_daemon_domain(system_cronjob_t, anacron_exec_t)
@@ -107,7 +107,7 @@ domain_cron_exemption_target(unconfined_cronjob_t)
 type user_cron_spool_t, cron_spool_type;
 typealias user_cron_spool_t alias { staff_cron_spool_t sysadm_cron_spool_t unconfined_cron_spool_t };
 typealias user_cron_spool_t alias { auditadm_cron_spool_t secadm_cron_spool_t };
-files_type(user_cron_spool_t)
+files_spool_file(user_cron_spool_t)
 ubac_constrained(user_cron_spool_t)
 mta_system_content(user_cron_spool_t)
 

diff --git a/policy/modules/services/ctdbd.te b/policy/modules/services/ctdbd.te
index 8ce09c40a51792b40296b2562905aa804b9bc562..82ba45e1e293c28f55661020a45b8962a60cc125 100644 (file)
--- a/policy/modules/services/ctdbd.te
+++ b/policy/modules/services/ctdbd.te
@@ -18,7 +18,7 @@ type ctdbd_log_t;
 logging_log_file(ctdbd_log_t)
 
 type ctdbd_spool_t;
-files_type(ctdbd_spool_t)
+files_spool_file(ctdbd_spool_t)
 
 type ctdbd_tmp_t;
 files_tmp_file(ctdbd_tmp_t)

diff --git a/policy/modules/services/dovecot.te b/policy/modules/services/dovecot.te
index 4bbff24bd3e272f7538bf2c750bbcc8316a434bf..87949e87356f639ef2191d23bed22d9d3a8ef9b2 100644 (file)
--- a/policy/modules/services/dovecot.te
+++ b/policy/modules/services/dovecot.te
@@ -39,7 +39,7 @@ type dovecot_passwd_t;
 files_type(dovecot_passwd_t)
 
 type dovecot_spool_t;
-files_type(dovecot_spool_t)
+files_spool_file(dovecot_spool_t)
 
 type dovecot_tmp_t;
 files_tmp_file(dovecot_tmp_t)

diff --git a/policy/modules/services/exim.te b/policy/modules/services/exim.te
index 0b19f11d836d7d5469facd480452addd174bf144..6419b554c68f3371f48d495afd17e790c5b34b08 100644 (file)
--- a/policy/modules/services/exim.te
+++ b/policy/modules/services/exim.te
@@ -42,7 +42,7 @@ type exim_log_t;
 logging_log_file(exim_log_t)
 
 type exim_spool_t;
-files_type(exim_spool_t)
+files_spool_file(exim_spool_t)
 
 type exim_tmp_t;
 files_tmp_file(exim_tmp_t)

diff --git a/policy/modules/services/inn.te b/policy/modules/services/inn.te
index dc7dd01ee1267c47014e5eb2dcaedaddc7ddb9b6..2462aa7b79b69d69b953ecf8104ab3c825ddddf1 100644 (file)
--- a/policy/modules/services/inn.te
+++ b/policy/modules/services/inn.te
@@ -26,6 +26,7 @@ files_pid_file(innd_var_run_t)
 
 type news_spool_t;
 files_mountpoint(news_spool_t)
+files_spool_file(news_spool_t)
 
 ########################################
 #

diff --git a/policy/modules/services/jabber.te b/policy/modules/services/jabber.te
index 0ba2bdc69e6789d600d03b429eadb6fbfa2bd705..6538d66a8d2382ccb82a5b2ca9dfcdbb9eefafe2 100644 (file)
--- a/policy/modules/services/jabber.te
+++ b/policy/modules/services/jabber.te
@@ -25,7 +25,7 @@ type pyicqt_log_t;
 logging_log_file(pyicqt_log_t);
 
 type pyicqt_var_spool_t;
-files_type(pyicqt_var_spool_t)
+files_spool_file(pyicqt_var_spool_t)
 
 type pyicqt_var_run_t;
 files_pid_file(pyicqt_var_run_t)

diff --git a/policy/modules/services/kerberos.fc b/policy/modules/services/kerberos.fc
index 923e979eee99c2bd75e1f88feff337c3ddcf488e..74ec098c5a82ea77853fb175909ed3b406fa67ce 100644 (file)
--- a/policy/modules/services/kerberos.fc
+++ b/policy/modules/services/kerberos.fc
@@ -30,5 +30,8 @@ HOME_DIR/\.k5login            --      gen_context(system_u:object_r:krb5_home_t,s0)
 /var/log/krb5kdc\.log                  gen_context(system_u:object_r:krb5kdc_log_t,s0)
 /var/log/kadmin(d)?\.log               gen_context(system_u:object_r:kadmind_log_t,s0)
 
+/var/cache/krb5rcache(/.*)?            gen_context(system_u:object_r:krb5_host_rcache_t,s0)
+
+krb5_host_rcache_t
 /var/tmp/host_0                        --      gen_context(system_u:object_r:krb5_host_rcache_t,s0)
 /var/tmp/HTTP_23               --      gen_context(system_u:object_r:krb5_host_rcache_t,s0)

diff --git a/policy/modules/services/lpd.te b/policy/modules/services/lpd.te
index c08de17e889d76b8e00352b78d9636c343188449..f28acd2ca76fb02485c8360e6a636eea6a4ea69b 100644 (file)
--- a/policy/modules/services/lpd.te
+++ b/policy/modules/services/lpd.te
@@ -47,7 +47,7 @@ ubac_constrained(lpr_tmp_t)
 type print_spool_t;
 typealias print_spool_t alias { user_print_spool_t staff_print_spool_t sysadm_print_spool_t };
 typealias print_spool_t alias { auditadm_print_spool_t secadm_print_spool_t };
-files_type(print_spool_t)
+files_spool_file(print_spool_t)
 ubac_constrained(print_spool_t)
 
 type printer_t;

diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te
index dbddbefa4296e4076fbd33f3e59773ca0890d931..3bd4ceb28e6fc1640e6b9273b46ae0e0fdbf55cf 100644 (file)
--- a/policy/modules/services/mta.te
+++ b/policy/modules/services/mta.te
@@ -25,9 +25,11 @@ userdom_user_home_content(mail_home_t)
 
 type mqueue_spool_t;
 files_mountpoint(mqueue_spool_t)
+files_spool_file(mqueue_spool_t)
 
 type mail_spool_t;
 files_mountpoint(mail_spool_t)
+files_spool_file(mail_spool_t)
 
 type sendmail_exec_t;
 mta_agent_executable(sendmail_exec_t)

diff --git a/policy/modules/services/nagios.te b/policy/modules/services/nagios.te
index 8a9789ce3f9479297d30c97a4178a005c2d613c9..971f741350f21a56cde5ff91ea0061f377a9b211 100644 (file)
--- a/policy/modules/services/nagios.te
+++ b/policy/modules/services/nagios.te
@@ -25,7 +25,7 @@ type nagios_var_run_t;
 files_pid_file(nagios_var_run_t)
 
 type nagios_spool_t;
-files_type(nagios_spool_t)
+files_spool_file(nagios_spool_t)
 
 nagios_plugin_template(admin)
 nagios_plugin_template(checkdisk)

diff --git a/policy/modules/services/plymouthd.te b/policy/modules/services/plymouthd.te
index 208ef3ab0a23d7c99a6ee4002c369cabf3d84066..4f9a5758eacd9a35f2fcd7d399c8480f66f19da5 100644 (file)
--- a/policy/modules/services/plymouthd.te
+++ b/policy/modules/services/plymouthd.te
@@ -15,7 +15,7 @@ type plymouthd_exec_t;
 init_daemon_domain(plymouthd_t, plymouthd_exec_t)
 
 type plymouthd_spool_t;
-files_type(plymouthd_spool_t)
+files_spool_file(plymouthd_spool_t)
 
 type plymouthd_var_lib_t;
 files_type(plymouthd_var_lib_t)

diff --git a/policy/modules/services/postfix.te b/policy/modules/services/postfix.te
index 701607cd17ac75c2fd51f9d561b683b7d4ddf6dc..c6a548017966c36eef466103b701da0b4889a818 100644 (file)
--- a/policy/modules/services/postfix.te
+++ b/policy/modules/services/postfix.te
@@ -21,7 +21,7 @@ attribute postfix_user_domtrans;
 postfix_server_domain_template(bounce)
 
 type postfix_spool_bounce_t, postfix_spool_type;
-files_type(postfix_spool_bounce_t)
+files_spool_file(postfix_spool_bounce_t)
 
 postfix_server_domain_template(cleanup)
 
@@ -78,13 +78,13 @@ mta_mailserver_sender(postfix_smtp_t)
 postfix_server_domain_template(smtpd)
 
 type postfix_spool_t, postfix_spool_type;
-files_type(postfix_spool_t)
+files_spool_file(postfix_spool_t)
 
 type postfix_spool_maildrop_t, postfix_spool_type;
-files_type(postfix_spool_maildrop_t)
+files_spool_file(postfix_spool_maildrop_t)
 
 type postfix_spool_flush_t, postfix_spool_type;
-files_type(postfix_spool_flush_t)
+files_spool_file(postfix_spool_flush_t)
 
 type postfix_public_t;
 files_type(postfix_public_t)

diff --git a/policy/modules/services/postgrey.te b/policy/modules/services/postgrey.te
index db843e2c26568b87d96cf23406f3cec9e887e986..4389e81dc81d2ea7f9caa1f38ed466cac303502c 100644 (file)
--- a/policy/modules/services/postgrey.te
+++ b/policy/modules/services/postgrey.te
@@ -16,7 +16,7 @@ type postgrey_initrc_exec_t;
 init_script_file(postgrey_initrc_exec_t)
 
 type postgrey_spool_t;
-files_type(postgrey_spool_t)
+files_spool_file(postgrey_spool_t)
 
 type postgrey_var_lib_t;
 files_type(postgrey_var_lib_t)

diff --git a/policy/modules/services/prelude.te b/policy/modules/services/prelude.te
index 8f0b07e68368df4246615f9fe30c5c13a77bacfc..e0c0f70c94d94ef6765c59341938f4cda0567dd1 100644 (file)
--- a/policy/modules/services/prelude.te
+++ b/policy/modules/services/prelude.te
@@ -13,7 +13,7 @@ type prelude_initrc_exec_t;
 init_script_file(prelude_initrc_exec_t)
 
 type prelude_spool_t;
-files_type(prelude_spool_t)
+files_spool_file(prelude_spool_t)
 
 type prelude_log_t;
 logging_log_file(prelude_log_t)

diff --git a/policy/modules/services/pyicqt.te b/policy/modules/services/pyicqt.te
index a841221ac27144db647e6aaddec91ce3d5550ae6..b62a01f981f9ec928d2a88f7ec885feeb67b8603 100644 (file)
--- a/policy/modules/services/pyicqt.te
+++ b/policy/modules/services/pyicqt.te
@@ -13,7 +13,7 @@ type pyicqt_conf_t;
 files_config_file(pyicqt_conf_t)
 
 type pyicqt_spool_t;
-files_type(pyicqt_spool_t)
+files_spool_file(pyicqt_spool_t)
 
 type pyicqt_var_run_t;
 files_pid_file(pyicqt_var_run_t)

diff --git a/policy/modules/services/qmail.te b/policy/modules/services/qmail.te
index 54329f90b81393733d4bd571e3c30288c44f5350..88e6f401c7c02b0cb5dd45fe381482f6b096736d 100644 (file)
--- a/policy/modules/services/qmail.te
+++ b/policy/modules/services/qmail.te
@@ -47,7 +47,7 @@ qmail_child_domain_template(qmail_smtpd, qmail_tcp_env_t)
 qmail_child_domain_template(qmail_splogger, qmail_start_t)
 
 type qmail_spool_t;
-files_type(qmail_spool_t)
+files_spool_file(qmail_spool_t)
 
 type qmail_start_t;
 type qmail_start_exec_t;

diff --git a/policy/modules/services/rpc.te b/policy/modules/services/rpc.te
index e8ee29bcac41313ae454c250ce5c19d107efa73f..06e637c0ee73e1e4f05b790955ab1a91b49b4f18 100644 (file)
--- a/policy/modules/services/rpc.te
+++ b/policy/modules/services/rpc.te
@@ -214,10 +214,10 @@ kernel_signal(gssd_t)
 
 corecmd_exec_bin(gssd_t)
 
-fs_search_nfsd_fs(gssd_t)
 fs_list_rpc(gssd_t)
 fs_rw_rpc_sockets(gssd_t)
 fs_read_rpc_files(gssd_t)
+fs_search_nfsd_fs(gssd_t)
 
 fs_list_inotifyfs(gssd_t)
 files_list_tmp(gssd_t)

diff --git a/policy/modules/services/rwho.te b/policy/modules/services/rwho.te
index 0ba4495b055cabdf70864619d2933717a885201c..ee3981096271e8cc71d7b92998a26a271ee6df4e 100644 (file)
--- a/policy/modules/services/rwho.te
+++ b/policy/modules/services/rwho.te
@@ -16,7 +16,7 @@ type rwho_log_t;
 files_type(rwho_log_t)
 
 type rwho_spool_t;
-files_type(rwho_spool_t)
+files_spool_file(rwho_spool_t)
 
 ########################################
 #

diff --git a/policy/modules/services/slrnpull.te b/policy/modules/services/slrnpull.te
index e5e72fd9e06a615e9f9a2d3350bd73de5c7e9bad..92eecec6df78e4ce8e2714e7356bd8c4e908e5f6 100644 (file)
--- a/policy/modules/services/slrnpull.te
+++ b/policy/modules/services/slrnpull.te
@@ -13,7 +13,7 @@ type slrnpull_var_run_t;
 files_pid_file(slrnpull_var_run_t)
 
 type slrnpull_spool_t;
-files_type(slrnpull_spool_t)
+files_spool_file(slrnpull_spool_t)
 
 type slrnpull_log_t;
 logging_log_file(slrnpull_log_t)

diff --git a/policy/modules/services/spamassassin.te b/policy/modules/services/spamassassin.te
index 7573826aa201c574d7cf3e666dff7d8ce39e1e78..e1f34778175906dc01ff5ef07713aab27703ba09 100644 (file)
--- a/policy/modules/services/spamassassin.te
+++ b/policy/modules/services/spamassassin.te
@@ -94,7 +94,7 @@ type spamd_log_t;
 logging_log_file(spamd_log_t)
 
 type spamd_spool_t;
-files_type(spamd_spool_t)
+files_spool_file(spamd_spool_t)
 
 type spamd_tmp_t;
 files_tmp_file(spamd_tmp_t)

diff --git a/policy/modules/services/uptime.te b/policy/modules/services/uptime.te
index 037a1e8ba89bd66d68c964f33940c6c84d9cf636..1f8f76853de3e362ad411a6500119297efccd4c4 100644 (file)
--- a/policy/modules/services/uptime.te
+++ b/policy/modules/services/uptime.te
@@ -13,7 +13,7 @@ type uptimed_etc_t alias etc_uptimed_t;
 files_config_file(uptimed_etc_t)
 
 type uptimed_spool_t;
-files_type(uptimed_spool_t)
+files_spool_file(uptimed_spool_t)
 
 type uptimed_var_run_t;
 files_pid_file(uptimed_var_run_t)

diff --git a/policy/modules/services/uucp.te b/policy/modules/services/uucp.te
index 4d112ba5b2746299f92ae58d75e604441d7c09f4..5e7be4f7dee97bb244ca7d7bc282fe40f18ef9eb 100644 (file)
--- a/policy/modules/services/uucp.te
+++ b/policy/modules/services/uucp.te
@@ -24,7 +24,7 @@ type uucpd_ro_t;
 files_type(uucpd_ro_t)
 
 type uucpd_spool_t;
-files_type(uucpd_spool_t)
+files_spool_file(uucpd_spool_t)
 
 type uucpd_log_t;
 logging_log_file(uucpd_log_t)

diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index bc547bf52d07639cd94bc34b8bc0090790d06470..0ad8e41b0c3e2b25f8d0fb22c031a4a4a9ee4fcb 100644 (file)
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -206,7 +206,7 @@ type xdm_rw_etc_t;
 files_config_file(xdm_rw_etc_t)
 
 type xdm_spool_t;
-files_type(xdm_spool_t)
+files_spool_file(xdm_spool_t)
 
 type xdm_var_lib_t;
 files_type(xdm_var_lib_t)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 82cf8aedaeeb7e06dd8fb1b6c17db69d5500ce7b..308297da3cabf7bb646a35afcb2fa1b8b7d5d8e1 100644 (file)
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -286,6 +286,7 @@ tunable_policy(`init_systemd',`
        dev_manage_sysfs_dirs(init_t)
        dev_relabel_sysfs_dirs(init_t)
 
+       files_search_all(init_t)
        files_mounton_all_mountpoints(init_t)
        files_unmount_all_file_type_fs(init_t)
        files_manage_all_pid_dirs(init_t)
@@ -293,6 +294,8 @@ tunable_policy(`init_systemd',`
        files_relabel_all_pid_files(init_t)
        files_create_all_pid_sockets(init_t)
        files_delete_all_pid_sockets(init_t)
+       files_create_all_spool_sockets(init_t)
+       files_delete_all_spool_sockets(init_t)
        files_manage_urandom_seed(init_t)
        files_list_locks(init_t)
        files_list_spool(init_t)

diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index eedd444fe1be15597315e97231675ab7012b2520..fa034d6a520c39ebf85f0be5ec0b9a314f038702 100644 (file)
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -20,7 +20,7 @@ files_security_file(auditd_log_t)
 files_security_mountpoint(auditd_log_t)
 
 type audit_spool_t;
-files_type(audit_spool_t)
+files_spool_file(audit_spool_t)
 files_security_file(audit_spool_t)
 files_security_mountpoint(audit_spool_t)