nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

container: allow container admins the sysadm capability in user

Browse Source 
namespaces

Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2022-12-07 10:49:39 -05:00
parent 810cc48197
commit 22ece2b57e
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/services/container.if
View File

@ -2518,7 +2518,7 @@ interface(`container_admin',`
allow $1 container_engine_domain:process { ptrace signal_perms };
ps_process_pattern($1, container_engine_domain)
allow $1 self:cap_userns { kill sys_ptrace };
allow $1 self:cap_userns { kill sys_ptrace sys_admin };
files_search_var_lib($1)
admin_pattern($1, container_var_lib_t)