External/passt
1
0
Fork 0
mirror of https://passt.top/passt synced 2025-01-21 19:55:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

selinux: Allow pasta_t to read nsfs entries

Browse Source 
This is needed to monitor filesystem-bound namespaces and quit when
they're gone -- this feature never really worked with SELinux.

Fixes: 745a9ba4284c ("pasta: By default, quit if filesystem-bound net namespace goes away")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Acked-by: Richard W.M. Jones <rjones@redhat.com>
This commit is contained in:
Stefano Brivio 2023-08-15 19:56:15 +02:00
parent 977652155d
commit 30817fdd4e
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
contrib/selinux/pasta.te
View File

@ -187,6 +187,8 @@ allow pasta_t sysctl_net_t:dir search;
allow pasta_t sysctl_net_t:file { open write };
allow pasta_t kernel_t:system module_request;
allow pasta_t nsfs_t:file read;
allow pasta_t net_conf_t:lnk_file read;
allow pasta_t proc_net_t:lnk_file read;