diff --git a/selinux/ipa.if b/selinux/ipa.if index 44c0a9366..cefae5d90 100644 --- a/selinux/ipa.if +++ b/selinux/ipa.if @@ -365,3 +365,30 @@ interface(`ipa_custodia_stream_connect',` allow $1 ipa_custodia_t:unix_stream_socket { connectto }; ') + +######################################## +## +## Manage apache pid objects. +## The interface is defined by selinux-policy since Fedora 31 and is +## conditionally defined here for Fedora 30. +## See https://pagure.io/freeipa/issue/8241. +## +## +## +## Domain allowed access. +## +## +# + +ifndef(`apache_manage_pid_files',` + interface(`apache_manage_pid_files',` + gen_require(` + type httpd_var_run_t; + ') + + files_search_pids($1) + manage_dirs_pattern($1, httpd_var_run_t, httpd_var_run_t) + manage_files_pattern($1, httpd_var_run_t, httpd_var_run_t) + manage_sock_files_pattern($1, httpd_var_run_t, httpd_var_run_t) + ') +')