From 30817fdd4e98e762973a390e293130e4bd7f2396 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Tue, 15 Aug 2023 19:56:15 +0200 Subject: selinux: Allow pasta_t to read nsfs entries This is needed to monitor filesystem-bound namespaces and quit when they're gone -- this feature never really worked with SELinux. Fixes: 745a9ba4284c ("pasta: By default, quit if filesystem-bound net namespace goes away") Signed-off-by: Stefano Brivio Acked-by: Richard W.M. Jones --- contrib/selinux/pasta.te | 2 ++ 1 file changed, 2 insertions(+) (limited to 'contrib') diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 86d9456..ce9186f 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -187,6 +187,8 @@ allow pasta_t sysctl_net_t:dir search; allow pasta_t sysctl_net_t:file { open write }; allow pasta_t kernel_t:system module_request; +allow pasta_t nsfs_t:file read; + allow pasta_t net_conf_t:lnk_file read; allow pasta_t proc_net_t:lnk_file read; -- cgit v1.2.3