1type fsverity_init, domain, coredomain; 2type fsverity_init_exec, exec_type, file_type, system_file_type; 3 4init_daemon_domain(fsverity_init) 5 6# Allow to read /proc/keys for searching key id. 7allow fsverity_init proc_keys:file r_file_perms; 8 9# Ignore denials to access irrelevant keys, as a side effect to access /proc/keys. 10dontaudit fsverity_init domain:key view; 11allow fsverity_init kernel:key { view search write setattr }; 12allow fsverity_init fsverity_init:key { view search write }; 13 14# Allow init to write to /proc/sys/fs/verity/require_signatures 15allow fsverity_init proc_fs_verity:file w_file_perms; 16 17# Read the on-device signing certificate, to be able to add it to the keyring 18allow fsverity_init odsign:fd use; 19allow fsverity_init odsign_data_file:file { getattr read }; 20 21# When kernel requests an algorithm, the crypto API first looks for an 22# already registered algorithm with that name. If it fails, the kernel creates 23# an implementation of the algorithm from templates. 24dontaudit fsverity_init kernel:system module_request; 25