From 8304d9b80b3cb22e429d2113cf81dca07d306dd7 Mon Sep 17 00:00:00 2001
From: Quintin Hill <stuff@quintin.me.uk>
Date: Fri, 2 Sep 2022 16:44:37 +0100
Subject: [PATCH] Allow systemd-gpt-auto-generator to check for empty dirs

systemd-gpt-auto-generator wants to check that certain subdirectories of / are empty before generating mount units for them this is not permitted by policy.

Addresses:
systemd-gpt-auto-generator[388]: Cannot check if "/home" is empty: Permission denied
kernel: audit: type=1400 audit(1662118200.418:80): avc:  denied  { read } for  pid=388 comm="systemd-gpt-aut" name="home" dev="sda2" ino=3180 scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir permissive=0
audit[388]: AVC avc:  denied  { read } for  pid=388 comm="systemd-gpt-aut" name="var" dev="sda2" ino=362569 scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=0
systemd-gpt-auto-generator[388]: Cannot check if "/var" is empty: Permission denied

Resolves: rhbz#2123765
Signed-off-by: lujie42 <lujie54@huawei.com>
---
 policy/modules/system/systemd.te | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index a9308b8cc..028820491 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1112,6 +1112,11 @@ dev_read_sysfs(systemd_gpt_generator_t)
 dev_write_kmsg(systemd_gpt_generator_t)
 dev_read_rand(systemd_gpt_generator_t)
 
+files_list_boot(systemd_gpt_generator_t)
+files_list_home(systemd_gpt_generator_t)
+files_list_tmp(systemd_gpt_generator_t)
+files_list_usr(systemd_gpt_generator_t)
+files_list_var(systemd_gpt_generator_t)
 
 fstools_exec(systemd_gpt_generator_t)
 
-- 
2.27.0