diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if index 09a203113..bf6e37bcf 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -710,6 +710,29 @@ interface(`init_getpgid',` allow $1 init_t:process getpgid; ') +######################################## +## +## Allow process to inherit resource limits. +## +##

+## This is applicable with systemd when using the +## options to limit resources - see +## https://www.freedesktop.org/software/systemd/man/systemd.exec.html#LimitMSGQUEUE= +##

+## +## +## Domain allowed access. +## +## +# +interface(`init_rlimit_inherit',` + gen_require(` + type init_t; + ') + + allow $1 init_t:process rlimitinh; +') + ######################################## ## ## Send init a generic signal.