From 9badc201cd17cd6d349bbd85e212f2924ebe5150 Mon Sep 17 00:00:00 2001
From: Mykola Solianko <mykola_solianko@epam.com>
Date: Thu, 12 Feb 2026 15:40:10 +0200
Subject: [PATCH] [dnsmasq] Allow rw initrc stream sockets and aos conf

Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
---
 policy/modules/services/dnsmasq.te |  4 ++++
 policy/modules/system/aos.if       | 19 +++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te
index fab57cef22..cccaa0d593 100644
--- a/policy/modules/services/dnsmasq.te
+++ b/policy/modules/services/dnsmasq.te
@@ -110,6 +110,10 @@ userdom_dontaudit_search_user_home_dirs(dnsmasq_t)
 
 files_manage_quota_aos(dnsmasq_t)
 
+init_rw_script_stream_sockets(dnsmasq_t)
+
+aos_rw_conf(dnsmasq_t)
+
 dev_rw_tee_chr_files(dnsmasq_t)
 
 kernel_use_fds(dnsmasq_t)
diff --git a/policy/modules/system/aos.if b/policy/modules/system/aos.if
index 2852cd0391..246186cb33 100644
--- a/policy/modules/system/aos.if
+++ b/policy/modules/system/aos.if
@@ -206,6 +206,25 @@ interface(`files_manage_overlay_aos',`
 ')	
 
 
+########################################
+## <summary>
+##	Read and write aos conf directories and files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`aos_rw_conf',`
+	gen_require(`
+		type aos_conf_t;
+	')
+
+	allow $1 aos_conf_t:dir rw_dir_perms;
+	allow $1 aos_conf_t:file rw_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Allow relabeled /var/aos directory.