nnd
/
selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

container: allow spc to map kubernetes runtime files 

Signed-off-by: Kenton Groombridge <concord@gentoo.org>
This commit is contained in:
Kenton Groombridge 2024-02-09 14:43:44 -05:00 committed by 0xC0ncord
parent fb548b6a72
commit fa3cf4f197
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/services/container.te
View File

@ -1145,6 +1145,7 @@ optional_policy(`
kubernetes_manage_runtime_dirs(spc_t)
kubernetes_mounton_runtime_dirs(spc_t)
kubernetes_manage_runtime_files(spc_t)
kubernetes_map_runtime_files(spc_t)
kubernetes_watch_runtime_files(spc_t)
kubernetes_manage_runtime_symlinks(spc_t)
kubernetes_manage_runtime_sock_files(spc_t)

18
policy/modules/services/kubernetes.if
View File

@ -641,6 +641,24 @@ interface(`kubernetes_manage_runtime_files',`
allow $1 kubernetes_runtime_t:file manage_file_perms;
')
########################################
## <summary>
## Memory map kubernetes runtime files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`kubernetes_map_runtime_files',`
gen_require(`
type kubernetes_runtime_t;
')
allow $1 kubernetes_runtime_t:file map;
')
########################################
## <summary>
## Watch kubernetes runtime files.