RepoMirrors/selinux-refpolicy
1
0
Fork 0
mirror of https://github.com/SELinuxProject/refpolicy synced 2025-03-11 07:40:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

userdomain: allow grant mac_admin capability to security admin

Browse Source 
cap_mac_admin is required to operate some LSM modules, such as
selinux, apparmor, smack, etc. It is necessary to allow the security
administrator role to grant this capability.

Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
This commit is contained in:
Tianjia Zhang 2025-01-16 10:38:28 +08:00
parent 94d9ea49b4
commit 4e7352b61f
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/system/userdomain.if
View File

@ -1497,6 +1497,7 @@ template(`userdom_admin_user_template',`
#
interface(`userdom_security_admin_template',`
allow $1 self:capability { dac_override dac_read_search };
allow $1 self:capability2 mac_admin;
corecmd_exec_shell($1)