From cc590f6e8c572c6023f8c4d5105e9c6cad0d94e8 Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:24:00 +0200 Subject: [PATCH 1/4] [init] Add init_mounton_initrc_runtime interface Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/system/init.if | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if index a301ed3053..04ad395fb5 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -3094,6 +3094,25 @@ interface(`init_manage_dir_utmp',` allow $1 initrc_runtime_t:dir manage_dir_perms; ') +######################################## +## +## Mounton initrc runtime files and directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`init_mounton_initrc_runtime',` + gen_require(` + type initrc_runtime_t; + ') + + allow $1 initrc_runtime_t:dir mounton; + allow $1 initrc_runtime_t:file mounton; +') + ######################################## ## ## Remove chr file perms from utmp. From cfdef723b4a4562c2dc9e526d7258933d85e1c9b Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:25:04 +0200 Subject: [PATCH 2/4] [iptables] Allow reading initrc runtime files Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/system/iptables.te | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te index b9b0b357d5..423356a44d 100644 --- a/policy/modules/system/iptables.te +++ b/policy/modules/system/iptables.te @@ -93,6 +93,7 @@ init_use_script_ptys(iptables_t) init_rw_script_pipes(iptables_t) init_rw_script_tmp_files(iptables_t) init_rw_script_stream_sockets(iptables_t) +init_read_utmp(iptables_t) logging_send_syslog_msg(iptables_t) From a7f84aa0f338f5c12e7425e6afce17c66fe43d59 Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:26:04 +0200 Subject: [PATCH 3/4] [dnsmasq] Allow managing initrc runtime for CNI Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/services/dnsmasq.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te index 4a0c3552f3..fab57cef22 100644 --- a/policy/modules/services/dnsmasq.te +++ b/policy/modules/services/dnsmasq.te @@ -53,6 +53,8 @@ allow dnsmasq_t dnsmasq_var_log_t:file setattr_file_perms; files_read_runtime_files(dnsmasq_t) systemd_read_resolved_dir(dnsmasq_t) files_map_etc_files(dnsmasq_t) +init_manage_utmp(dnsmasq_t) +init_manage_dir_utmp(dnsmasq_t) systemd_read_resolved_runtime(dnsmasq_t) From cbc9dd2967e6af61a9ecc3cca9e84a6cad25f16f Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:26:56 +0200 Subject: [PATCH 4/4] [container] Allow managing initrc runtime dirs and files Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/services/container.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te index 8e159d0ab3..385ac1b52e 100644 --- a/policy/modules/services/container.te +++ b/policy/modules/services/container.te @@ -756,6 +756,9 @@ kernel_request_load_module(container_engine_t) term_remount_devpts(container_engine_t) init_rw_script_stream_sockets(container_engine_t) +init_manage_utmp(container_engine_t) +init_manage_dir_utmp(container_engine_t) +init_mounton_initrc_runtime(container_engine_t) ifdef(`init_systemd',` # needed by runc, which is also invoked by other engines