From 8271ab906f4389dae37b0470c44cdc6ab15b784d Mon Sep 17 00:00:00 2001 From: Kenton Groombridge Date: Mon, 6 May 2024 16:39:41 -0400 Subject: container: allow containers to getcap Signed-off-by: Kenton Groombridge --- policy/modules/services/container.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te index 9699ac36..68aa97ae 100644 --- a/policy/modules/services/container.te +++ b/policy/modules/services/container.te @@ -286,7 +286,7 @@ corenet_port(container_port_t) dontaudit container_domain self:capability fsetid; dontaudit container_domain self:capability2 block_suspend; allow container_domain self:cap_userns { chown dac_override dac_read_search fowner kill setgid setuid }; -allow container_domain self:process { execstack execmem getattr getsched getsession setsched setcap setpgid signal_perms }; +allow container_domain self:process { execstack execmem getattr getcap getsched getsession setsched setcap setpgid signal_perms }; allow container_domain self:dir rw_dir_perms; allow container_domain self:file create_file_perms; allow container_domain self:fifo_file manage_fifo_file_perms; -- cgit v1.2.3-65-gdbad