commit: 8271ab906f4389dae37b0470c44cdc6ab15b784d Author: Kenton Groombridge <concord <AT> gentoo <DOT> org> AuthorDate: Mon May 6 20:39:41 2024 +0000 Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org> CommitDate: Tue May 14 17:41:49 2024 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=8271ab90
container: allow containers to getcap Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org> policy/modules/services/container.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te index 9699ac36d..68aa97ae5 100644 --- a/policy/modules/services/container.te +++ b/policy/modules/services/container.te @@ -286,7 +286,7 @@ corenet_port(container_port_t) dontaudit container_domain self:capability fsetid; dontaudit container_domain self:capability2 block_suspend; allow container_domain self:cap_userns { chown dac_override dac_read_search fowner kill setgid setuid }; -allow container_domain self:process { execstack execmem getattr getsched getsession setsched setcap setpgid signal_perms }; +allow container_domain self:process { execstack execmem getattr getcap getsched getsession setsched setcap setpgid signal_perms }; allow container_domain self:dir rw_dir_perms; allow container_domain self:file create_file_perms; allow container_domain self:fifo_file manage_fifo_file_perms;