diff options
| author |   Kenton Groombridge <me@concord.sh> | 2023-02-10 13:30:56 -0500 |
|---|---|---|
| committer |   Kenton Groombridge <concord@gentoo.org> | 2023-02-13 10:24:11 -0500 |
| commit | c891d981f2fd465d682c8129865613927308c30e (patch) | |
| tree | 8935f67dfb467a77bc4a7ccafa77525ed95d8b99 /policy/modules/services/container.te | |
| parent | lvm: Add fc entry for /etc/multipath/* (diff) | |
| download | hardened-refpolicy-c891d981f2fd465d682c8129865613927308c30e.tar.gz hardened-refpolicy-c891d981f2fd465d682c8129865613927308c30e.tar.bz2 hardened-refpolicy-c891d981f2fd465d682c8129865613927308c30e.zip | |
container: add missing filetrans and filecon for containerd/docker
Add a missing file transition for the docker socket in /run as well as a
missing file context for /var/log/containerd.
Thanks-to: zen_desu
Signed-off-by: Kenton Groombridge <me@concord.sh>
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
Diffstat (limited to 'policy/modules/services/container.te')
| -rw-r--r-- | policy/modules/services/container.te | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te index 534d6f4c..15d1e8c8 100644 --- a/policy/modules/services/container.te +++ b/policy/modules/services/container.te @@ -747,7 +747,7 @@ allow container_engine_system_domain container_runtime_t:file { manage_file_perm allow container_engine_system_domain container_runtime_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms }; allow container_engine_system_domain container_runtime_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms }; allow container_engine_system_domain container_runtime_t:sock_file { manage_sock_file_perms relabel_sock_file_perms }; -files_runtime_filetrans(container_engine_system_domain, container_runtime_t, { dir file }) +files_runtime_filetrans(container_engine_system_domain, container_runtime_t, { dir file sock_file }) allow container_engine_system_domain container_engine_cache_t:dir manage_dir_perms; allow container_engine_system_domain container_engine_cache_t:file manage_file_perms; |