+##
+## Allow rpcd_t to manage fuse files
+##
+##
+gen_tunable(rpcd_use_fusefs, false)
+
attribute rpc_domain;
type exports_t;
@@ -135,6 +142,8 @@ manage_dirs_pattern(rpcd_t, rpcd_var_run_t, rpcd_var_run_t)
manage_files_pattern(rpcd_t, rpcd_var_run_t, rpcd_var_run_t)
files_pid_filetrans(rpcd_t, rpcd_var_run_t, { file dir })
+read_lnk_files_pattern(rpcd_t, var_lib_nfs_t, var_lib_nfs_t)
+
# rpc.statd executes sm-notify
can_exec(rpcd_t, rpcd_exec_t)
@@ -171,6 +180,13 @@ miscfiles_read_generic_certs(rpcd_t)
userdom_signal_unpriv_users(rpcd_t)
userdom_read_user_home_content_files(rpcd_t)
+tunable_policy(`rpcd_use_fusefs',`
+ fs_manage_fusefs_dirs(rpcd_t)
+ fs_manage_fusefs_files(rpcd_t)
+ fs_read_fusefs_symlinks(rpcd_t)
+ fs_getattr_fusefs(rpcd_t)
+')
+
ifdef(`distro_debian',`
term_dontaudit_use_unallocated_ttys(rpcd_t)
')
diff --git a/samba.te b/samba.te
index bf7a710..aac4015 100644
--- a/samba.te
+++ b/samba.te
@@ -726,6 +726,7 @@ userdom_use_inherited_user_terminals(smbcontrol_t)
optional_policy(`
ctdbd_stream_connect(smbcontrol_t)
+ ctdbd_sigchld(smbcontrol_t)
')
########################################