nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

systemd: systemd-cgroups reads kernel.cap_last_cap sysctl.

Browse Source 
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
This commit is contained in:
Chris PeBenito 2022-07-07 13:45:12 +00:00 committed by Chris PeBenito
parent 56e33b7e42
commit d1ec6f1b9f
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
policy/modules/system/systemd.te
View File

@ -414,6 +414,9 @@ fs_register_binary_executable_type(systemd_binfmt_t)
allow systemd_cgroups_t self:capability net_admin;
kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
# read kernel.cap_last_cap
kernel_read_kernel_sysctls(systemd_cgroups_t)
kernel_dontaudit_getattr_proc(systemd_cgroups_t)
# for /proc/cmdline
kernel_read_system_state(systemd_cgroups_t)