From fa3cf4f19758e9d35371521e8bb636aa256799af Mon Sep 17 00:00:00 2001
From: Kenton Groombridge <concord@gentoo.org>
Date: Fri, 9 Feb 2024 14:43:44 -0500
Subject: [PATCH] container: allow spc to map kubernetes runtime files

Signed-off-by: Kenton Groombridge <concord@gentoo.org>
---
 policy/modules/services/container.te  |  1 +
 policy/modules/services/kubernetes.if | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te
index 0e29369e8..0b798993c 100644
--- a/policy/modules/services/container.te
+++ b/policy/modules/services/container.te
@@ -1145,6 +1145,7 @@ optional_policy(`
 	kubernetes_manage_runtime_dirs(spc_t)
 	kubernetes_mounton_runtime_dirs(spc_t)
 	kubernetes_manage_runtime_files(spc_t)
+	kubernetes_map_runtime_files(spc_t)
 	kubernetes_watch_runtime_files(spc_t)
 	kubernetes_manage_runtime_symlinks(spc_t)
 	kubernetes_manage_runtime_sock_files(spc_t)
diff --git a/policy/modules/services/kubernetes.if b/policy/modules/services/kubernetes.if
index ea6ecd1d5..de14a7b61 100644
--- a/policy/modules/services/kubernetes.if
+++ b/policy/modules/services/kubernetes.if
@@ -641,6 +641,24 @@ interface(`kubernetes_manage_runtime_files',`
 	allow $1 kubernetes_runtime_t:file manage_file_perms;
 ')
 
+########################################
+## <summary>
+##	Memory map kubernetes runtime files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`kubernetes_map_runtime_files',`
+	gen_require(`
+		type kubernetes_runtime_t;
+	')
+
+	allow $1 kubernetes_runtime_t:file map;
+')
+
 ########################################
 ## <summary>
 ##	Watch kubernetes runtime files.