From 4f38bdac3398b6ed66192896decdb2a16d50d52d Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:24:00 +0200 Subject: [PATCH 1/4] [init] Add init_mounton_initrc_runtime interface Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/system/init.if | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if index a301ed3053..04ad395fb5 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -3094,6 +3094,25 @@ interface(`init_manage_dir_utmp',` allow $1 initrc_runtime_t:dir manage_dir_perms; ') +######################################## +## +## Mounton initrc runtime files and directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`init_mounton_initrc_runtime',` + gen_require(` + type initrc_runtime_t; + ') + + allow $1 initrc_runtime_t:dir mounton; + allow $1 initrc_runtime_t:file mounton; +') + ######################################## ## ## Remove chr file perms from utmp. From 78247ea970dae8e1944bffef645936f6ae704594 Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:25:04 +0200 Subject: [PATCH 2/4] [iptables] Allow reading initrc runtime files Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/system/iptables.te | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te index b9b0b357d5..423356a44d 100644 --- a/policy/modules/system/iptables.te +++ b/policy/modules/system/iptables.te @@ -93,6 +93,7 @@ init_use_script_ptys(iptables_t) init_rw_script_pipes(iptables_t) init_rw_script_tmp_files(iptables_t) init_rw_script_stream_sockets(iptables_t) +init_read_utmp(iptables_t) logging_send_syslog_msg(iptables_t) From 0d3aef25d1e01b5324579ce2036f1a886cebb59c Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:26:04 +0200 Subject: [PATCH 3/4] [dnsmasq] Allow managing initrc runtime for CNI Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/services/dnsmasq.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te index 4a0c3552f3..fab57cef22 100644 --- a/policy/modules/services/dnsmasq.te +++ b/policy/modules/services/dnsmasq.te @@ -53,6 +53,8 @@ allow dnsmasq_t dnsmasq_var_log_t:file setattr_file_perms; files_read_runtime_files(dnsmasq_t) systemd_read_resolved_dir(dnsmasq_t) files_map_etc_files(dnsmasq_t) +init_manage_utmp(dnsmasq_t) +init_manage_dir_utmp(dnsmasq_t) systemd_read_resolved_runtime(dnsmasq_t) From 43fd25aa4c3fd0bce0c23f3c26b1ddb5f6173b18 Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:26:56 +0200 Subject: [PATCH 4/4] [container] Allow managing initrc runtime dirs and files Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/services/container.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te index 51c80a3fa3..7408f19dc4 100644 --- a/policy/modules/services/container.te +++ b/policy/modules/services/container.te @@ -754,6 +754,9 @@ kernel_search_vm_sysctl(container_engine_t) term_remount_devpts(container_engine_t) init_rw_script_stream_sockets(container_engine_t) +init_manage_utmp(container_engine_t) +init_manage_dir_utmp(container_engine_t) +init_mounton_initrc_runtime(container_engine_t) ifdef(`init_systemd',` # needed by runc, which is also invoked by other engines