From da5328319db49846fb698d262c13f06230091bfb Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Fri, 28 Jan 2022 19:01:45 +0100
Subject: [PATCH] Allow init delete generic tmp named pipes

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/da5328319db49846fb698d262c13f06230091bfb
Conflict: NA

The files_delete_tmp_pipes() interface was added.

Addresses the following AVC denial:
type=AVC msg=audit(1628676879.222:1003): avc:  denied  { unlink } for  pid=1 comm="systemd" name="controller_log_37116" dev="tmpfs" ino=1235 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=fifo_file permissive=0

Resolves: rhbz#1992562
Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/kernel/files.if | 18 ++++++++++++++++++
 policy/modules/system/init.te  |  1 +
 2 files changed, 19 insertions(+)

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index bca6f15..53e463c 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -6153,6 +6153,24 @@ interface(`files_delete_tmp_sockets',`
 
 ########################################
 ## <summary>
+##	Delete generic tmp named pipes
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_delete_tmp_pipes',`
+       gen_require(`
+		type tmp_t;
+       ')
+
+       delete_fifo_files_pattern($1, tmp_t, tmp_t)
+')
+
+########################################
+## <summary>
 ##	Remove entries from the tmp directory.
 ## </summary>
 ## <param name="domain">
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index a81f5da..09a6925 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -648,6 +648,7 @@ files_read_kernel_modules(init_t)
 files_map_kernel_modules(init_t)
 files_dontaudit_mounton_isid(init_t)
 files_delete_tmp_files(init_t)
+files_delete_tmp_pipes(init_t)
 files_delete_tmp_sockets(init_t)
 fs_getattr_all_fs(init_t)
 fs_manage_cgroup_dirs(init_t)
-- 
1.8.3.1