commit: ec7d886c63f83a6e50cbe816f255a653c2d8b17c
Author: Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Mon Oct 30 07:32:33 2017 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Oct 30 08:39:42 2017 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=ec7d886c
salt: master and minion need to map tmpfs files
policy/modules/contrib/salt.te | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/policy/modules/contrib/salt.te b/policy/modules/contrib/salt.te
index 9a8a4ad8..2eb7b7db 100644
--- a/policy/modules/contrib/salt.te
+++ b/policy/modules/contrib/salt.te
@@ -72,6 +72,9 @@ files_type(salt_minion_pki_t)
type salt_minion_tmp_t;
files_tmp_file(salt_minion_tmp_t)
+type salt_minion_tmpfs_t;
+files_tmpfs_file(salt_minion_tmpfs_t)
+
type salt_minion_var_run_t;
init_daemon_pid_file(salt_minion_var_run_t, file, "salt-minion.pid")
files_pid_file(salt_minion_var_run_t)
@@ -144,7 +147,7 @@ files_tmp_filetrans(salt_master_t, salt_master_tmp_t, {
file dir })
can_exec(salt_master_t, salt_master_tmp_t)
# salt_master_tmpfs_t
-allow salt_master_t salt_master_tmpfs_t:file manage_file_perms;
+allow salt_master_t salt_master_tmpfs_t:file { manage_file_perms map };
fs_tmpfs_filetrans(salt_master_t, salt_master_tmpfs_t, file)
# salt_master_var_run_t
@@ -262,6 +265,10 @@ files_tmp_filetrans(salt_minion_t, salt_minion_tmp_t, {
file dir })
# libffi, screw you
can_exec(salt_minion_t, salt_minion_tmp_t)
+# salt_minion_tmpfs_t
+allow salt_minion_t salt_minion_tmpfs_t:file { manage_file_perms map };
+fs_tmpfs_filetrans(salt_minion_t, salt_minion_tmpfs_t, file)
+
# salt_minion_var_run_t
allow salt_minion_t salt_minion_var_run_t:file manage_file_perms;
allow salt_minion_t salt_minion_var_run_t:sock_file manage_sock_file_perms;
