diff mbox series

[testsuite,22/24] policy: give sysadm_t perms needed to run quotacheck(8)

Message ID 20220729120229.207584-23-omosnace@redhat.com (mailing list archive)
State Superseded
Delegated to: Ondrej Mosnáček
Headers show
Series Clean up testsuite policy and support running as sysadm_t | expand

Commit Message

Ondrej Mosnacek July 29, 2022, 12:02 p.m. UTC 
Unfortunately this is not allowed in the Fedora policy currently, so we
need to work around it.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
 policy/test_global.te | 4 ++++
 1 file changed, 4 insertions(+)
diff mbox series

Patch

diff --git a/policy/test_global.te b/policy/test_global.te
index 7d399e6..2592553 100644
--- a/policy/test_global.te
+++ b/policy/test_global.te
@@ -58,6 +58,10 @@  optional_policy(`
 	# Allow the test domain to be entered from sysadm_t
 	sysadm_entry_spec_domtrans_to(testsuite_domain)
 
+	# Needed for quotacheck(8) in the filesystem test to succeed
+	fs_remount_xattr_fs(sysadm_t)
+	storage_raw_read_fixed_disk(sysadm_t)
+
 	# Let sysadm_t use runcon to run the test programs in various domains.
 	#allow sysadm_t self:process setexec;
 	#selinux_get_fs_mount(sysadm_t)