From 7d9150db0ac72cde46b48b916daefa6e70a751b0 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Tue, 21 Feb 2023 18:06:05 +0000 Subject: selinux/passt.te: Allow setcap on the process itself This is needed by the new functions in isolate.c, add the corresponding rule. Signed-off-by: Stefano Brivio --- contrib/selinux/passt.te | 1 + 1 file changed, 1 insertion(+) (limited to 'contrib/selinux/passt.te') diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index 12a4288..45d56c2 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -90,6 +90,7 @@ allow passt_t user_devpts_t:chr_file { getattr read write ioctl }; logging_send_syslog_msg(passt_t) allow syslogd_t self:cap_userns sys_ptrace; +allow passt_t self:process setcap; allow passt_t self:capability { sys_tty_config setpcap net_bind_service }; allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace }; -- cgit v1.2.3