Improve domain_transition_pattern to allow mmap entrypoint bin file.
In domain_transition_pattern there is rule: allow $1 $2:file { getattr open read execute }; map permission is missing here, which is generating lot of AVC. Replacing permissions with mmap_exec_file_perms set.
This commit is contained in:
parent
e9eec95de4
commit
a7edcc9f2b
|
@ -7,7 +7,7 @@
|
|||
# 3. target domain
|
||||
#
|
||||
define(`domain_transition_pattern',`
|
||||
allow $1 $2:file { getattr open read execute };
|
||||
allow $1 $2:file { mmap_exec_file_perms };
|
||||
allow $1 $3:process transition;
|
||||
dontaudit $1 $3:process { noatsecure siginh rlimitinh };
|
||||
')
|
||||
|
|
Loading…
Reference in New Issue