From 87745f09d952fd76c7a7efc9fc789613e923bafa Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Wed, 13 Nov 2019 14:23:57 -0500 Subject: [PATCH] unconfined: Add namespaced capabilities. Signed-off-by: Chris PeBenito --- policy/modules/system/unconfined.if | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if index 0a2f7a860..f2867c18f 100644 --- a/policy/modules/system/unconfined.if +++ b/policy/modules/system/unconfined.if @@ -20,8 +20,8 @@ interface(`unconfined_domain_noaudit',` ') # Use most Linux capabilities - allow $1 self:capability { chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap }; - allow $1 self:capability2 { syslog wake_alarm }; + allow $1 self:{ capability cap_userns } { chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap }; + allow $1 self:{ capability2 cap2_userns } { syslog wake_alarm }; allow $1 self:fifo_file manage_fifo_file_perms; # Transition to myself, to make get_ordered_context_list happy.