From b75e34887410c756e09763994cce88584a214da2 Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Thu, 8 Dec 2022 20:06:14 +0100
Subject: [PATCH] Allow systemd-timedated watch init runtime dir

Addresses the following AVC denial:
Dec 08 06:43:24 audit[7055]: AVC avc:  denied  { watch } for  pid=7055 comm="systemd-timesyn" path="/run/systemd" dev="tmpfs" ino=2 scontext=system_u:system_r:systemd_timedated_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=0

Resolves: rhbz#2151806
---
 policy/modules/system/systemd.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 8fb7509147..3a6fd02c3e 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1017,6 +1017,7 @@ fs_getattr_xattr_fs(systemd_timedated_t)
 
 init_dbus_chat(systemd_timedated_t)
 init_status(systemd_timedated_t)
+init_watch_pid_dir(systemd_timedated_t)
 
 kernel_read_network_state(systemd_timedated_t)
 
