init, systemd: move locallogin pidfd access to systemd-logind

This access is actually required by systemd-logind, not systemd-init. Signed-off-by: Kenton Groombridge <[email protected]>
0xC0ncord · Jun 30, 2024 · b279fa4 · b279fa4
1 parent 7c79790
commit b279fa4
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
@@ -620,10 +620,6 @@ ifdef(`init_systemd',`
 		kubernetes_read_config(init_t)
 	')
 
-	optional_policy(`
-		locallogin_use_pidfds(init_t)
-	')
-
 	optional_policy(`
 		# var-lib-nfs-rpc_pipefs.mount creates /var/lib/nfs/rpc_pipefs
 		# if it does not exist

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
@@ -1070,6 +1070,10 @@ optional_policy(`
 	devicekit_dbus_chat_power(systemd_logind_t)
 ')
 
+optional_policy(`
+	locallogin_use_pidfds(systemd_logind_t)
+')
+
 optional_policy(`
 	modemmanager_dbus_chat(systemd_logind_t)
 ')