mirror/flatpak
1
0
Fork 0
mirror of https://github.com/flatpak/flatpak.git synced 2026-07-05 21:57:16 -04:00
Code Issues Packages Projects Releases Wiki Activity

selinux: Let the system helper watch files inside $libexecdir

Browse Source 
The system-helper (ie., the `flatpak-system-helper` process) is
labelled with flatpak_helper_exec_t and runs in the flatpak_helper_t
domain, and tries to set up an inotify(7) watch on it's own binary so
that it can exit when the binary is replaced.  This explicitly permits
it to do so to avoid running into SELinux denials.

The corecmd_watch_bin_dirs SELinux interface is a recent addition [1],
and is therefore used conditionally when defined.

[1] https://github.com/fedora-selinux/selinux-policy/commit/88072fd293
    https://github.com/fedora-selinux/selinux-policy/pull/1133

https://bugzilla.redhat.com/show_bug.cgi?id=2053634
(cherry picked from commit f8a9153d0e)
This commit is contained in:
Debarshi Ray
2022-04-12 20:56:06 +02:00
committed by Simon McVittie
parent cdfda66101
commit 248b1f9ffe
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
selinux/flatpak.te
View File

@@ -14,6 +14,10 @@ init_daemon_domain(flatpak_helper_t, flatpak_helper_exec_t)
auth_read_passwd(flatpak_helper_t)
ifdef(`corecmd_watch_bin_dirs',`
corecmd_watch_bin_dirs(flatpak_helper_t)
')
optional_policy(`
dbus_stub()
dbus_system_domain(flatpak_helper_t, flatpak_helper_exec_t)