RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

container: Getattr generic device nodes. 

There should be no device_t device nodes, but add access in case they
exist. Saw containerd fail to start containers if it couldn't stat() all
devices.

Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
This commit is contained in:
Chris PeBenito 2022-05-23 15:23:27 +00:00 committed by Chris PeBenito
parent 1caf5c6dc1
commit 136d1b724b
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/services/container.te
View File

@ -422,6 +422,8 @@ corenet_rw_tun_tap_dev(container_engine_domain)
dev_getattr_all_blk_files(container_engine_domain)
dev_getattr_all_chr_files(container_engine_domain)
dev_getattr_generic_blk_files(container_engine_domain)
dev_getattr_generic_chr_files(container_engine_domain)
dev_setattr_null_dev(container_engine_domain)
dev_getattr_fs(container_engine_domain)
dev_remount_fs(container_engine_domain)