Allow sysadm_t and staff_t roles to manage user systemd services BZ(1531864)

wrabcak · wrabcak · commit cc4a89232bf2 · 2018-01-10T10:26:55.000+01:00
diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
@@ -21,6 +21,9 @@ gen_tunable(staff_use_svirt, false)
 #
 # Local policy
 #
+
+allow staff_t self:system all_system_perms;
+
 corenet_ib_access_unlabeled_pkeys(staff_t)
 
 kernel_read_ring_buffer(staff_t)
@@ -255,6 +258,7 @@ optional_policy(`
 
 optional_policy(`
 	systemd_read_unit_files(staff_t)
+    systemd_config_all_services(staff_t)
 	systemd_exec_systemctl(staff_t)
 ')
 
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
@@ -10,6 +10,8 @@ role sysadm_r;
 userdom_admin_user_template(sysadm)
 allow sysadm_t self:netlink_tcpdiag_socket create_netlink_socket_perms;
 
+allow sysadm_t self:system all_system_perms;
+
 
 ########################################
 #

Original file line number	Diff line number	Diff line change
`@@ -21,6 +21,9 @@ gen_tunable(staff_use_svirt, false)`
`21`	`21`	`#`
`22`	`22`	`# Local policy`
`23`	`23`	`#`
	`24`	`+`
	`25`	`+allow staff_t self:system all_system_perms;`
	`26`	`+`
`24`	`27`	`corenet_ib_access_unlabeled_pkeys(staff_t)`
`25`	`28`
`26`	`29`	`kernel_read_ring_buffer(staff_t)`
@@ -255,6 +258,7 @@ optional_policy(`
`255`	`258`
`256`	`259`	optional_policy(`
`257`	`260`	`systemd_read_unit_files(staff_t)`
	`261`	`+ systemd_config_all_services(staff_t)`
`258`	`262`	`systemd_exec_systemctl(staff_t)`
`259`	`263`	`')`
`260`	`264`
Original file line number	Diff line number	Diff line change
`@@ -10,6 +10,8 @@ role sysadm_r;`
`10`	`10`	`userdom_admin_user_template(sysadm)`
`11`	`11`	`allow sysadm_t self:netlink_tcpdiag_socket create_netlink_socket_perms;`
`12`	`12`
	`13`	`+allow sysadm_t self:system all_system_perms;`
	`14`	`+`
`13`	`15`
`14`	`16`	`########################################`
`15`	`17`	`#`