From f8a9153d0ed464dbd1668976bf5b00edc845c80d Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Tue, 12 Apr 2022 20:56:06 +0200 Subject: selinux: Let the system helper watch files inside $libexecdir The system-helper (ie., the `flatpak-system-helper` process) is labelled with flatpak_helper_exec_t and runs in the flatpak_helper_t domain, and tries to set up an inotify(7) watch on it's own binary so that it can exit when the binary is replaced. This explicitly permits it to do so to avoid running into SELinux denials. The corecmd_watch_bin_dirs SELinux interface is a recent addition [1], and is therefore used conditionally when defined. [1] https://github.com/fedora-selinux/selinux-policy/commit/88072fd293 https://github.com/fedora-selinux/selinux-policy/pull/1133 https://bugzilla.redhat.com/show_bug.cgi?id=2053634 --- selinux/flatpak.te | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'selinux') diff --git a/selinux/flatpak.te b/selinux/flatpak.te index 871ffa29..0bb77631 100644 --- a/selinux/flatpak.te +++ b/selinux/flatpak.te @@ -14,6 +14,10 @@ init_daemon_domain(flatpak_helper_t, flatpak_helper_exec_t) auth_read_passwd(flatpak_helper_t) +ifdef(`corecmd_watch_bin_dirs',` + corecmd_watch_bin_dirs(flatpak_helper_t) +') + optional_policy(` dbus_stub() dbus_system_domain(flatpak_helper_t, flatpak_helper_exec_t) -- cgit v1.2.1