Commit f8a1b72b6388

@@ -105,16 +105,18 @@ module nix-systemd 1.0;
 
 require {
     type init_t;
-    type nix_store_t;
+    type default_t;
     class file { read open getattr execute execute_no_trans map };
     class dir { search getattr open read };
     class lnk_file { read getattr };
 }
 
-# Allow systemd to follow symlinks into /nix/store for unit files
-allow init_t nix_store_t:dir { search getattr open read };
-allow init_t nix_store_t:file { read open getattr execute execute_no_trans map };
-allow init_t nix_store_t:lnk_file { read getattr };
+# Allow systemd (init_t) to read unit files with default_t context
+# This occurs when system-manager symlinks units into /etc/systemd/system/
+# pointing to /nix/store paths which have default_t SELinux context
+allow init_t default_t:dir { search getattr open read };
+allow init_t default_t:file { read open getattr execute execute_no_trans map };
+allow init_t default_t:lnk_file { read getattr };
 POLICY
 
 	checkmodule -M -m -o "${tmpdir}/nix-systemd.mod" "${tmpdir}/nix-systemd.te"