From 6732acf8b74f1989cd241bd9a267482cb418c2f4 Mon Sep 17 00:00:00 2001
From: Corentin LABBE <clabbe.montjoie@gmail.com>
Date: Thu, 5 Jan 2023 16:42:10 +0100
Subject: [PATCH] mandb: permit to read inherited cron files

Each night /etc/cron.daily/man-db generates some AVC:
allow mandb_t system_cronjob_tmp_t:file { read write };

Add the necessary rules for it.

Signed-off-by: Corentin LABBE <clabbe.montjoie@gmail.com>
---
 policy/modules/apps/mandb.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/apps/mandb.te b/policy/modules/apps/mandb.te
index f136a90ae..5dd7cf7a5 100644
--- a/policy/modules/apps/mandb.te
+++ b/policy/modules/apps/mandb.te
@@ -59,5 +59,6 @@ ifdef(`init_systemd',`
 ')
 
 optional_policy(`
+	cron_rw_inherited_system_job_tmp_files(mandb_t)
 	cron_system_entry(mandb_t, mandb_exec_t)
 ')