From 489674d8ad8253a18cf88425f2fe3dbf265d03a1 Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Mon, 17 Jan 2022 12:44:10 +0100
Subject: [PATCH] Allow sysadm_t start and stop transient services

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/489674d8ad8253a18cf88425f2fe3dbf265d03a1
Conflict: NA

Addresses the following AVC denial:

type=USER_AVC msg=audit(01/07/2022 03:27:48.362:345) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc:  denied  { start } for auid=unset uid=root gid=root cmdline="" scontext=sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:init_t:s0 tclass=system permissive=1  exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' # Date:      Mon Jan 17 12:44:10 2022 +0100

Resolves: rhbz#2031065
Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/roles/sysadm.te | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index fae8028..d9e11b6 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -81,6 +81,8 @@ init_exec(sysadm_t)
 init_exec_script_files(sysadm_t)
 init_dbus_chat(sysadm_t)
 init_script_role_transition(sysadm_r)
+init_start(sysadm_t)
+init_stop(sysadm_t)
 init_status(sysadm_t)
 init_reboot(sysadm_t)
 init_halt(sysadm_t)
-- 
1.8.3.1