diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 725ed0207a..d2c0219b62 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -879,6 +879,7 @@ optional_policy(` ') optional_policy(` + systemd_homed_cache_filetrans(init_t) systemd_homed_dbus_chat(init_t) systemd_homed_write_pipes(init_t) ') diff --git a/policy/modules/system/systemd-homed.if b/policy/modules/system/systemd-homed.if index c54361b8a7..f7ade61112 100644 --- a/policy/modules/system/systemd-homed.if +++ b/policy/modules/system/systemd-homed.if @@ -78,3 +78,23 @@ interface(`systemd_homed_write_pipes',` write_fifo_files_pattern($1, systemd_homed_runtime_dir_t, systemd_homed_runtime_pipe_t) ') +######################################## +## +## Create /var/cache/systemd/home +## with a private type using a type_transition. +## +## +## +## Domain allowed access. +## +## +# +interface(`systemd_homed_cache_filetrans',` + gen_require(` + type systemd_homed_cache_t; + ') + + optional_policy(` + systemd_cache_filetrans($1, systemd_homed_cache_t, dir, "home") + ') +') diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if index 1bd0ecd569..20363fa30d 100644 --- a/policy/modules/system/systemd.if +++ b/policy/modules/system/systemd.if @@ -3081,3 +3081,37 @@ interface(`systemd_nsresourced_prog_run_bpf',` allow $1 systemd_nsresourced_t:bpf { map_read map_write prog_run }; ') + +######################################## +## +## Create objects in /var/cache/systemd +## with a private type using a type_transition. +## +## +## +## Domain allowed access. +## +## +## +## +## Private file type. +## +## +## +## +## Object classes to be created. +## +## +## +## +## The name of the object being created. +## +## +# +interface(`systemd_cache_filetrans',` + gen_require(` + type systemd_cache_t; + ') + + filetrans_pattern($1, systemd_cache_t, $2, $3, $4) +')