[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/services/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     93685fc8ed051425c610d8f1f3ab76d9fefbb956
Author:     Marc Schiffbauer <mschiff <AT> gentoo <DOT> org>
AuthorDate: Tue Jun 24 16:39:08 2025 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Jul 15 08:04:55 2025 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=93685fc8

dnsmasq: make dnsmasq work with systemd-resolved

Signed-off-by: Marc Schiffbauer <mschiff <AT> gentoo.org>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/services/dnsmasq.te |  6 ++++++
 policy/modules/system/systemd.if   | 18 ++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te
index 270f2a21a..ff66c5763 100644
--- a/policy/modules/services/dnsmasq.te
+++ b/policy/modules/services/dnsmasq.te
@@ -130,6 +130,12 @@ optional_policy(`
 	seutil_sigchld_newrole(dnsmasq_t)
 ')
 
+optional_policy(`
+	systemd_read_resolved_runtime(dnsmasq_t)
+	systemd_list_resolved_runtime(dnsmasq_t)
+	systemd_watch_resolved_runtime_dirs(dnsmasq_t)
+')
+
 optional_policy(`
 	tftp_read_content(dnsmasq_t)
 ')

diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index e7419cc30..7e58453df 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -2331,6 +2331,24 @@ interface(`systemd_read_networkd_runtime',`
 	read_files_pattern($1, systemd_networkd_runtime_t, systemd_networkd_runtime_t)
 ')
 
+#######################################
+## <summary>
+##	Watch directories under /run/systemd/resolve
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain permitted the access
+##	</summary>
+## </param>
+#
+interface(`systemd_watch_resolved_runtime_dirs',`
+	gen_require(`
+		type systemd_resolved_runtime_t;
+	')
+
+	allow $1 systemd_resolved_runtime_t:dir watch;
+')
+
 #######################################
 ## <summary>
 ##  Connect to systemd-nsresourced over