diff --git a/policy/modules/contrib/virt.if b/policy/modules/contrib/virt.if index d4112ac364..66446a5ca7 100644 --- a/policy/modules/contrib/virt.if +++ b/policy/modules/contrib/virt.if @@ -2237,6 +2237,25 @@ interface(`virt_virtqemud_read_state',` ps_process_pattern($1, virtqemud_t) ') +######################################## +## +## Read the svirt process state. +## +## +## +## Domain allowed access. +## +## +# +interface(`virt_svirt_read_state',` + gen_require(` + type svirt_t; + ') + + kernel_search_proc($1) + ps_process_pattern($1, svirt_t) +') + ######################################## ## ## Execute virsh in the caller domain. diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index a37ddf6962..f8323045d0 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -631,6 +631,7 @@ optional_policy(` virt_rw_svirt_dev(systemd_machined_t) virt_getattr_sandbox_filesystem(systemd_machined_t) virt_read_sandbox_files(systemd_machined_t) + virt_svirt_read_state(systemd_machined_t) ') #######################################