diff options
| author |   Kenton Groombridge <concord@gentoo.org> | 2024-05-06 16:39:41 -0400 |
|---|---|---|
| committer | Kenton Groombridge <concord@gentoo.org> | 2024-05-14 13:41:49 -0400 |
| commit | 8271ab906f4389dae37b0470c44cdc6ab15b784d (patch) | |
| tree | c6ba419825cf65cd0c077cd6ffb34669b5f9540e | |
| parent | container: allow system container engines to mmap runtime files (diff) | |
| download | hardened-refpolicy-8271ab906f4389dae37b0470c44cdc6ab15b784d.tar.gz hardened-refpolicy-8271ab906f4389dae37b0470c44cdc6ab15b784d.tar.bz2 hardened-refpolicy-8271ab906f4389dae37b0470c44cdc6ab15b784d.zip | |
container: allow containers to getcap
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
| -rw-r--r-- | policy/modules/services/container.te | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te index 9699ac36d..68aa97ae5 100644 --- a/policy/modules/services/container.te +++ b/policy/modules/services/container.te @@ -286,7 +286,7 @@ corenet_port(container_port_t) dontaudit container_domain self:capability fsetid; dontaudit container_domain self:capability2 block_suspend; allow container_domain self:cap_userns { chown dac_override dac_read_search fowner kill setgid setuid }; -allow container_domain self:process { execstack execmem getattr getsched getsession setsched setcap setpgid signal_perms }; +allow container_domain self:process { execstack execmem getattr getcap getsched getsession setsched setcap setpgid signal_perms }; allow container_domain self:dir rw_dir_perms; allow container_domain self:file create_file_perms; allow container_domain self:fifo_file manage_fifo_file_perms; |