diff --git a/policy/modules/contrib/accountsd.te b/policy/modules/contrib/accountsd.te index 5c2ddce255..c3cfd87c81 100644 --- a/policy/modules/contrib/accountsd.te +++ b/policy/modules/contrib/accountsd.te @@ -86,6 +86,7 @@ optional_policy(` optional_policy(` gnome_initial_setup_read_state(accountsd_t) + gnome_initial_setup_read_tmp_files(accountsd_t) ') optional_policy(` diff --git a/policy/modules/contrib/gnome.if b/policy/modules/contrib/gnome.if index d4b74dc31d..a09b91571a 100644 --- a/policy/modules/contrib/gnome.if +++ b/policy/modules/contrib/gnome.if @@ -2226,6 +2226,25 @@ interface(`gnome_initial_setup_write_fifo_files',` allow $1 gnome_initial_setup_t:fifo_file write_fifo_file_perms; ') +######################################## +## +## Read gnome-initial-setup tmp files +## +## +## +## Domain allowed access. +## +## +# +interface(`gnome_initial_setup_read_tmp_files',` + gen_require(` + type gnome_initial_setup_t; + ') + + + allow $1 gnome_initial_setup_tmp_t:file read_file_perms; +') + ######################################## ## ## Transition to gnome-initial-setup named content diff --git a/policy/modules/contrib/gnome.te b/policy/modules/contrib/gnome.te index 0902bfe7d3..7f7977f6b0 100644 --- a/policy/modules/contrib/gnome.te +++ b/policy/modules/contrib/gnome.te @@ -83,6 +83,9 @@ files_type(gnome_initial_setup_var_lib_t); type gnome_initial_setup_var_run_t; files_pid_file(gnome_initial_setup_var_run_t); +type gnome_initial_setup_tmp_t; +files_tmp_file(gnome_initial_setup_tmp_t); + type gnomesystemmm_t; type gnomesystemmm_exec_t; init_daemon_domain(gnomesystemmm_t, gnomesystemmm_exec_t) @@ -364,6 +367,9 @@ manage_sock_files_pattern(gnome_initial_setup_t, gnome_initial_setup_var_run_t, files_pid_filetrans(gnome_initial_setup_t, gnome_initial_setup_var_run_t, dir) allow gnome_initial_setup_t gnome_initial_setup_var_run_t:file map; +manage_files_pattern(gnome_initial_setup_t, gnome_initial_setup_tmp_t, gnome_initial_setup_tmp_t) +files_tmp_filetrans(gnome_initial_setup_t, gnome_initial_setup_tmp_t, file) + rw_files_pattern(gnome_initial_setup_t, config_home_t, config_home_t) allow gnome_initial_setup_t config_home_t:file map;