aboutgitcodebugslistschat
path: root/contrib/selinux
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2023-02-21 18:06:05 +0000
committerStefano Brivio <sbrivio@redhat.com>2023-02-21 19:12:37 +0100
commit7d9150db0ac72cde46b48b916daefa6e70a751b0 (patch)
tree1735bc9c14369a3fc9f2b512985c0b017cb63100 /contrib/selinux
parent01801b131f21f126b341f0db069727d6f9bd8d2e (diff)
downloadpasst-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar
passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar.gz
passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar.bz2
passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar.lz
passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar.xz
passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.tar.zst
passt-7d9150db0ac72cde46b48b916daefa6e70a751b0.zip
selinux/passt.te: Allow setcap on the process itself
This is needed by the new functions in isolate.c, add the corresponding rule. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'contrib/selinux')
-rw-r--r--contrib/selinux/passt.te1
1 files changed, 1 insertions, 0 deletions
diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
index 12a4288..45d56c2 100644
--- a/contrib/selinux/passt.te
+++ b/contrib/selinux/passt.te
@@ -90,6 +90,7 @@ allow passt_t user_devpts_t:chr_file { getattr read write ioctl };
logging_send_syslog_msg(passt_t)
allow syslogd_t self:cap_userns sys_ptrace;
+allow passt_t self:process setcap;
allow passt_t self:capability { sys_tty_config setpcap net_bind_service };
allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace };