From 8346b7b48da4695513a8018f8e66b17c08a5e81d Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 2 Sep 2024 17:26:21 +0200 Subject: [PATCH] Update bootupd policy for the removing-state-file test How to reproduce: Install a Fedora Silverblue 41 system run sudo rm /boot/bootupd-state.json run sudo bootupctl update The commit addresses the following AVC denial example: type=AVC msg=audit(1725290040.770:431): avc: denied { open } for pid=4524 comm="bootupctl" path="/boot/efi/EFI/BOOT/BOOTIA32.EFI" dev="vda1" ino=142 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1 Resolves: https://github.com/fedora-selinux/selinux-policy/issues/2334 --- policy/modules/contrib/bootupd.te | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/policy/modules/contrib/bootupd.te b/policy/modules/contrib/bootupd.te index 5e86b8a555..f4fb56f610 100644 --- a/policy/modules/contrib/bootupd.te +++ b/policy/modules/contrib/bootupd.te @@ -39,9 +39,11 @@ domain_use_interactive_fds(bootupd_t) files_create_boot_dirs(bootupd_t) files_read_etc_files(bootupd_t) +files_manage_boot_files(bootupd_t) fs_getattr_all_fs(bootupd_t) -fs_search_dos(bootupd_t) +fs_manage_dos_dirs(bootupd_t) +fs_manage_dos_files(bootupd_t) fs_search_efivarfs_dirs(bootupd_t) optional_policy(`