From 25bdcfdf5821ddba2c47fc4306bc43debc4c0f75 Mon Sep 17 00:00:00 2001
From: Patrik Koncity <pkoncity@redhat.com>
Date: Mon, 31 Jan 2022 13:06:49 +0100
Subject: [PATCH] Allow domtrans to sssd_t and role access to sssd

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/25bdcfdf5821ddba2c47fc4306bc43debc4c0f75
Conflict: NA

After previous fix in bugzilla arise a SELinux
error with role. Processes running under
unconfined_r do not have access to sssd_t.
Allow domain transition from rpm_script_t to
sssd_t and allow the rpm_script_roles in the
sssd domain.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2022690
Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/contrib/rpm.te | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/policy/modules/contrib/rpm.te b/policy/modules/contrib/rpm.te
index 0866d95..b09dfe1 100644
--- a/policy/modules/contrib/rpm.te
+++ b/policy/modules/contrib/rpm.te
@@ -489,6 +489,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	sssd_run_sssd(rpm_script_t, rpm_script_roles)
+')
+
+optional_policy(`
 	tzdata_domtrans(rpm_t)
 	tzdata_run(rpm_script_t, rpm_script_roles)
 ')
-- 
1.8.3.1