nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

iptables: Ioctl cgroup dirs.

Browse Source 
avc:  denied  { ioctl } for  pid=7230 comm="ip6tables" path="/sys/fs/cgroup" dev="cgroup2" ino=1
scontext=system_u:system_r:iptables_t:s0
tcontext=system_u:object_r:cgroup_t:s0 tclass=dir

Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
This commit is contained in:
Chris PeBenito 2022-05-02 18:14:55 +00:00 committed by Chris PeBenito
parent 80683a4f0f
commit f8739276a5
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
policy/modules/kernel/filesystem.if
View File

@ -770,6 +770,25 @@ interface(`fs_list_cgroup_dirs', `
dev_search_sysfs($1)
')
########################################
## <summary>
## Ioctl cgroup directories.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`fs_ioctl_cgroup_dirs', `
gen_require(`
type cgroup_t;
')
allow $1 cgroup_t:dir ioctl;
dev_search_sysfs($1)
')
########################################
## <summary>
## Delete cgroup directories.

1
policy/modules/system/iptables.te
View File

@ -75,6 +75,7 @@ dev_dontaudit_write_mtrr(iptables_t)
fs_getattr_xattr_fs(iptables_t)
fs_search_auto_mountpoints(iptables_t)
fs_list_inotifyfs(iptables_t)
fs_ioctl_cgroup_dirs(iptables_t)
mls_file_read_all_levels(iptables_t)