Allow local_login_t to start systemd units

Needed by qrexec possibly?
QubesOS · Dec 23, 2022 · 1f235d8 · 1f235d8
1 parent db5ed05
commit 1f235d8
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/selinux/qubes-misc.te b/selinux/qubes-misc.te
@@ -2,9 +2,12 @@ policy_module(qubes-misc,0.0.1)
 require {
 	type systemd_modules_load_t;
 	type iptables_t, xen_device_t;
+	type local_login_t, init_t;
 	class chr_file { read write };
+	class service { start };
 }
 
 type qubes_var_run_t;
 logging_dgram_send(systemd_modules_load_t)
 allow iptables_t xen_device_t:chr_file { read write };
+allow local_login_t init_t: service { start };