From 07b06a7f6cb1f41b92de5d29d21ac89c4d362457 Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Tue, 7 Dec 2021 17:15:44 +0100
Subject: [PATCH] Allow systemd read unlabeled symbolic links

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/07b06a7f6cb1f41b92de5d29d21ac89c4d362457
Conflict: NA

On a system boot systemd starts to launch services in the current target.
When it attempts to access a symbolic link which is critical for systemd
to continue and the symlink is unlabeled, the autorelabel target cannot
be reached to start relabeling and fix the unlabeled files.
This scenario applies to /etc/localtime when it was changed in SELinux
disabled mode.

Since this commit, systemd is allowed the read access to symbolic links
with the unlabeled_t type.

Resolves: rhbz#2021835
Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/kernel/kernel.if | 18 ++++++++++++++++++
 policy/modules/system/init.te   |  1 +
 2 files changed, 19 insertions(+)

diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 62845c1..1b684f5 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -2922,6 +2922,24 @@ interface(`kernel_dontaudit_getattr_unlabeled_blk_files',`
 
 ########################################
 ## <summary>
+##	Read unlabeled symbolic links.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kernel_read_unlabeled_lnk_files',`
+	gen_require(`
+		type unlabeled_t;
+	')
+
+	allow $1 unlabeled_t:lnk_file read_lnk_file_perms;
+')
+
+########################################
+## <summary>
 ##	Read and write unlabeled block device nodes.
 ## </summary>
 ## <param name="domain">
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 22e363a..0de5f4a 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -588,6 +588,7 @@ tunable_policy(`deny_bluetooth',`',`
 ')
 
 kernel_list_unlabeled(init_t)
+kernel_read_unlabeled_lnk_files(init_t)
 kernel_read_network_state(init_t)
 kernel_rw_all_sysctls(init_t)
 kernel_rw_security_state(init_t)
-- 
1.8.3.1