69 строки
1.7 KiB
Diff
69 строки
1.7 KiB
Diff
From 5c142d954fb3139abe9506fa01eae244042d8093 Mon Sep 17 00:00:00 2001
|
|
From: Chris PeBenito <Christopher.PeBenito@microsoft.com>
|
|
Date: Thu, 9 Feb 2023 19:27:37 +0000
|
|
Subject: [PATCH 27/35] cloud-init: Allow use of sudo in runcmd.
|
|
|
|
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
|
|
---
|
|
policy/modules/admin/cloudinit.te | 14 ++++++++++++++
|
|
policy/modules/admin/sudo.if | 19 +++++++++++++++++++
|
|
2 files changed, 33 insertions(+)
|
|
|
|
MSFT_TAG: pending
|
|
|
|
diff --git a/policy/modules/admin/cloudinit.te b/policy/modules/admin/cloudinit.te
|
|
index 377891941..ec0db3209 100644
|
|
--- a/policy/modules/admin/cloudinit.te
|
|
+++ b/policy/modules/admin/cloudinit.te
|
|
@@ -114,6 +114,20 @@ optional_policy(`
|
|
rpm_domtrans(cloud_init_t)
|
|
')
|
|
|
|
+optional_policy(`
|
|
+ # If sudo is used in runcmd:
|
|
+ allow cloud_init_t self:capability sys_resource;
|
|
+ allow cloud_init_t self:process { setrlimit setsched };
|
|
+
|
|
+ sudo_exec(cloud_init_t)
|
|
+
|
|
+ userdom_search_user_runtime(cloud_init_t)
|
|
+
|
|
+ optional_policy(`
|
|
+ systemd_write_inherited_logind_sessions_pipes(cloud_init_t)
|
|
+ ')
|
|
+')
|
|
+
|
|
optional_policy(`
|
|
systemd_dbus_chat_hostnamed(cloud_init_t)
|
|
')
|
|
diff --git a/policy/modules/admin/sudo.if b/policy/modules/admin/sudo.if
|
|
index 4840c740c..06867833d 100644
|
|
--- a/policy/modules/admin/sudo.if
|
|
+++ b/policy/modules/admin/sudo.if
|
|
@@ -229,3 +229,22 @@ interface(`sudo_sigchld',`
|
|
|
|
allow $1 sudodomain:process sigchld;
|
|
')
|
|
+
|
|
+########################################
|
|
+## <summary>
|
|
+## Execute sudo in the caller domain.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`sudo_exec',`
|
|
+ gen_require(`
|
|
+ type sudo_exec_t;
|
|
+ ')
|
|
+
|
|
+ can_exec($1, sudo_exec_t)
|
|
+ corecmd_search_bin($1)
|
|
+')
|
|
--
|
|
2.34.1
|
|
|