nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

container: allow containers to read read-only container files

Browse Source 
Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2021-12-31 14:04:16 -05:00
parent e272db844c
commit 4aca3bab15
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
policy/modules/services/container.te
View File

@ -137,6 +137,13 @@ rw_chr_files_pattern(container_domain, container_file_t, container_file_t)
rw_blk_files_pattern(container_domain, container_file_t, container_file_t)
allow container_domain container_file_t:dir_file_class_set watch;
allow container_domain container_ro_file_t:blk_file read_blk_file_perms;
allow container_domain container_ro_file_t:dir list_dir_perms;
allow container_domain container_ro_file_t:chr_file read_chr_file_perms;
allow container_domain container_ro_file_t:file { exec_file_perms read_file_perms };
allow container_domain container_ro_file_t:lnk_file read_lnk_file_perms;
allow container_domain container_ro_file_t:sock_file read_sock_file_perms;
can_exec(container_domain, container_file_t)
kernel_getattr_proc(container_domain)