[lvm] Allow cgroup serach dir

Signed-off-by: Mykola Solianko <[email protected]>
aosedge · Aug 16, 2024 · 865f891 · 865f891
1 parent f278d77
commit 865f891
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
@@ -1170,6 +1170,24 @@ interface(`fs_watch_cgroup_dirs', `
 	allow $1 cgroup_t:dir watch;
 ')
 
+########################################
+## <summary>
+##	Search cgroup directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_search_cgroup_dirs', `
+	gen_require(`
+		type cgroup_t;
+	')
+
+	allow $1 cgroup_t:dir search;
+')
+
 ########################################
 ## <summary>
 ##	Mount on cgroup directories.

diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te
@@ -222,6 +222,7 @@ manage_aos_sem(lvm_t)
 
 files_allow_manage_var_files(lvm_t)
 files_manage_var_dirs(lvm_t)
+fs_search_cgroup_dirs(lvm_t)
 
 miscfiles_manage_generic_cert_dirs(lvm_t)
 fs_manage_bpf_dirs(lvm_t)