From dc983b88ad1043c43de1cc19d579debcd10a778d Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Tue, 15 Feb 2022 11:44:23 +0100
Subject: [PATCH] Allow userdomain read symlinks in /var/lib

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/dc983b88ad1043c43de1cc19d579debcd10a778d
Conflict: NA

Addresses the following AVC denial:

type=PROCTITLE msg=audit(02/15/22 11:39:56.020:247) : proctitle=/usr/bin/gnome-software --gapplication-service
type=PATH msg=audit(02/15/22 11:39:56.020:247) : item=0 name=/var/lib/flatpak/appstream/flathub/x86_64/active/appstream.xml.gz nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(02/15/22 11:39:56.020:247) : cwd=/home/user
type=SYSCALL msg=audit(02/15/22 11:39:56.020:247) : arch=x86_64 syscall=access success=no exit=EACCES(Permission denied) a0=0x7fb66c6f8da0 a1=F_OK a2=0x0 a3=0x20 items=1 ppid=1460 pid=2035 auid=user uid=user gid=user euid=user suid=user fsuid=user egid=user sgid=user fsgid=user tty=(none) ses=3 comm=pool-org.gnome. exe=/usr/bin/gnome-software subj=user_u:user_r:user_t:s0 key=(null)
type=AVC msg=audit(02/15/22 11:39:56.020:247) : avc:  denied  { read } for  pid=2035 comm=pool-org.gnome. name=active dev="vda2" ino=387091 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=lnk_file permissive=0

Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/system/userdomain.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index 69b460f..3ac8c12 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -387,6 +387,7 @@ tunable_policy(`deny_bluetooth',`',`
 dev_watch_generic_dirs(login_userdomain)
 
 files_map_var_lib_files(login_userdomain)
+files_read_var_lib_symlinks(login_userdomain)
 files_watch_etc_dirs(login_userdomain)
 files_watch_etc_files(login_userdomain)
 files_watch_system_conf_dirs(login_userdomain)
-- 
1.8.3.1