diff options
| author | 7ppKb5bW <pONy4THS@protonmail.com> | 2025-02-02 19:21:21 +0000 |
|---|---|---|
| committer | Stefano Brivio <sbrivio@redhat.com> | 2025-02-03 07:33:14 +0100 |
| commit | bf2860819d868c7d116923e9b5d798d410d38715 (patch) | |
| tree | f795f117dbef409c3e29d7e8d5e2cfc51cd7b46c | |
| parent | dcd6d8191aa29f232593ad2819a197e135f8cac8 (diff) | |
| download | passt-bf2860819d868c7d116923e9b5d798d410d38715.tar passt-bf2860819d868c7d116923e9b5d798d410d38715.tar.gz passt-bf2860819d868c7d116923e9b5d798d410d38715.tar.bz2 passt-bf2860819d868c7d116923e9b5d798d410d38715.tar.lz passt-bf2860819d868c7d116923e9b5d798d410d38715.tar.xz passt-bf2860819d868c7d116923e9b5d798d410d38715.tar.zst passt-bf2860819d868c7d116923e9b5d798d410d38715.zip | |
pasta.te: fix demo.sh and remove one duplicate rule
On Fedora 41, without "allow pasta_t unconfined_t:dir read"
/usr/bin/pasta can't open /proc/[pid]/ns, which is required by
pasta_netns_quit_init().
This patch also remove one duplicate rule "allow pasta_t nsfs_t:file
read;", "allow pasta_t nsfs_t:file { open read };" at line 123 is
enough.
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
| -rw-r--r-- | contrib/selinux/pasta.te | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 69be081..d0ff0cc 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -171,7 +171,7 @@ allow pasta_t init_t:lnk_file read; allow pasta_t init_t:unix_stream_socket connectto; allow pasta_t init_t:dbus send_msg; allow pasta_t init_t:system status; -allow pasta_t unconfined_t:dir search; +allow pasta_t unconfined_t:dir { read search }; allow pasta_t unconfined_t:file read; allow pasta_t unconfined_t:lnk_file read; allow pasta_t self:process { setpgid setcap }; @@ -192,8 +192,6 @@ allow pasta_t sysctl_net_t:dir search; allow pasta_t sysctl_net_t:file { open read write }; allow pasta_t kernel_t:system module_request; -allow pasta_t nsfs_t:file read; - allow pasta_t proc_t:dir mounton; allow pasta_t proc_t:filesystem mount; allow pasta_t net_conf_t:lnk_file read; |