nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

container: fixes for podman run --log-driver=passthrough

Browse Source 
The --log-driver=passthrough argument is used by default for units
generated by quadlet. Without this access, containers started through
systemd in this way will not be able to send logs to the journal.

Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2023-02-24 20:46:36 -05:00
parent d2ec3ce6e4
commit 6894aaa796
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
policy/modules/services/container.te
View File

@ -304,6 +304,9 @@ clock_read_adjtime(container_domain)
init_read_utmp(container_domain)
init_dontaudit_write_utmp(container_domain)
# for podman run --log-driver=passthrough
init_rw_stream_sockets(container_domain)
init_use_fds(container_domain)
libs_dontaudit_setattr_lib_files(container_domain)