Skip to contentSkip to conversation

mandb: fixes for systemd timer and /usr/local/man label

PATCH New Christian Göttsche 2 participants 2 messages Sep 10, 2017 – Sep 11, 2017

lore
Share & tools
lore

Christian Göttsche

author
#0 lore raw

PATCH 1/1 mandb: fixes for systemd timer and /usr/local/man label

---
 mandb.te | 7 +++++++
 1 file changed, 7 insertions(+)
mandb.te +7 -0
index 5c759da..27d5fff 100644
@@ -16,6 +16,11 @@ role mandb_roles types mandb_t;
 type mandb_unit_t;
 init_unit_file(mandb_unit_t)
 
+ifdef(`init_systemd',`
+	# run as systemd timer
+	init_system_domain(mandb_t, mandb_exec_t)
+')
+
 ########################################
 #
 # Local policy

@@ -40,6 +45,8 @@ domain_use_interactive_fds(mandb_t)
 
 files_dontaudit_search_home(mandb_t)
 files_read_etc_files(mandb_t)
+# /usr/local/man
+files_read_usr_symlinks(mandb_t)
 # search /var/run/nscd/socket
 files_search_pids(mandb_t)
Signature · 1 line
2.14.1
#1 lore raw

PATCH 1/1 mandb: fixes for systemd timer and /usr/local/man label

Quoted 9 lines · Christian G?ttsche via refpolicy
---
  mandb.te | 7 +++++++
  1 file changed, 7 insertions(+)
mandb.te +0 -0
index 5c759da..27d5fff 100644

mandb.te role mandb_roles types mandb_t; · line 22

Quoted 7 lines
mandb.te +4 -0
@@ -16,6 +16,11 @@ role mandb_roles types mandb_t;
  type mandb_unit_t;
  init_unit_file(mandb_unit_t)
 
+ifdef(`init_systemd',`
+	# run as systemd timer
+	init_system_domain(mandb_t, mandb_exec_t)
+')

I don't think this needs to be a build option.

Quoted 13 lines
mandb.te +2 -0
  ########################################
  #
  # Local policy

@@ -40,6 +45,8 @@ domain_use_interactive_fds(mandb_t)
 
  files_dontaudit_search_home(mandb_t)
  files_read_etc_files(mandb_t)
+# /usr/local/man
+files_read_usr_symlinks(mandb_t)
  # search /var/run/nscd/socket
  files_search_pids(mandb_t)
Signature · 1 line
Chris PeBenito