Improve domain_transition_pattern to allow mmap entrypoint bin file.

In domain_transition_pattern there is rule:
allow $1 $2:file { getattr open read execute };

map permission is missing here, which is generating lot of AVC.
Replacing permissions with mmap_exec_file_perms set.
This commit is contained in:
Lukas Vrabec 2018-07-20 00:17:27 +02:00 committed by Chris PeBenito
parent e9eec95de4
commit a7edcc9f2b
1 changed files with 1 additions and 1 deletions

View File

@ -7,7 +7,7 @@
# 3. target domain
#
define(`domain_transition_pattern',`
allow $1 $2:file { getattr open read execute };
allow $1 $2:file { mmap_exec_file_perms };
allow $1 $3:process transition;
dontaudit $1 $3:process { noatsecure siginh rlimitinh };
')