File _service:tar_scm_kernel_repo:backport-Allow-log... of Package selinux-policy

File _service:tar_scm_kernel_repo:backport-Allow-login_userdomain-watch-generic-directories-in-.patch of Package selinux-policy

From 7821ccab9e2f62f5d4ac8f2ea8ef45d12f4bb7a2 Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Thu, 13 Jan 2022 22:38:29 +0100
Subject: [PATCH] Allow login_userdomain watch generic directories in /tmp

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/7821ccab9e2f62f5d4ac8f2ea8ef45d12f4bb7a2
Conflict: NA

Addresses the following AVC denial:

type=PROCTITLE msg=audit(13.1.2022 21:50:49.647:21417) : proctitle=/usr/lib64/firefox/firefox --sm-client-id 10cddccc67000160673165200000017210015
type=PATH msg=audit(13.1.2022 21:50:49.647:21417) : item=0 name=/tmp inode=1 dev=00:25 mode=dir,sticky,777 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:tmp_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=SYSCALL msg=audit(13.1.2022 21:50:49.647:21417) : arch=x86_64 syscall=inotify_add_watch success=yes exit=21 a0=0x50 a1=0x7fee2f76f1d0 a2=0x1002fce a3=0xdaddb2ff3800000 items=1 ppid=1775 pid=1088343 auid=username uid=username gid=username euid=username suid=username fsuid=username egid=username sgid=username fsgid=username tty=(none) ses=3 comm=GeckoMain exe=/usr/lib64/firefox/firefox subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(13.1.2022 21:50:49.647:21417) : avc:  denied  { watch } for  pid=1088343 comm=GeckoMain path=/tmp dev="tmpfs" ino=1 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir permissive=1

Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/system/userdomain.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index 9f778ee..cc2d309 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -389,6 +389,7 @@ dev_watch_generic_dirs(login_userdomain)
 files_watch_etc_dirs(login_userdomain)
 files_watch_usr_dirs(login_userdomain)
 files_watch_var_lib_dirs(login_userdomain)
+files_watch_generic_tmp_dirs(login_userdomain)
 
 fs_create_cgroup_files(login_userdomain)
 fs_watch_cgroup_files(login_userdomain)
-- 
1.8.3.1