diff options
| author | Stefano Brivio <sbrivio@redhat.com> | 2023-02-21 18:06:05 +0000 |
|---|---|---|
| committer | Stefano Brivio <sbrivio@redhat.com> | 2023-02-21 19:12:37 +0100 |
| commit | 7d9150db0ac72cde46b48b916daefa6e70a751b0 (patch) | |
| tree | 1735bc9c14369a3fc9f2b512985c0b017cb63100 /contrib/selinux/passt.te | |
| parent | 01801b131f21f126b341f0db069727d6f9bd8d2e (diff) | |
| download | passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar.gz passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar.bz2 passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar.lz passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar.xz passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar.zst passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.zip | |
selinux/passt.te: Allow setcap on the process itself
This is needed by the new functions in isolate.c, add the
corresponding rule.
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'contrib/selinux/passt.te')
| -rw-r--r-- | contrib/selinux/passt.te | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index 12a4288..45d56c2 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -90,6 +90,7 @@ allow passt_t user_devpts_t:chr_file { getattr read write ioctl }; logging_send_syslog_msg(passt_t) allow syslogd_t self:cap_userns sys_ptrace; +allow passt_t self:process setcap; allow passt_t self:capability { sys_tty_config setpcap net_bind_service }; allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace }; |