commit: 502084fa7b0f2a22c1d6c2f25f3dae7a54008dee Author: Kenton Groombridge <me <AT> concord <DOT> sh> AuthorDate: Thu Mar 31 19:02:13 2022 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Sat Apr 9 19:28:30 2022 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=502084fa
podman: add rules for systemd container units Allow conmon to use init file descriptors and read-write init unix stream sockets. This is in support of containers started as systemd units. Signed-off-by: Kenton Groombridge <me <AT> concord.sh> Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> policy/modules/services/podman.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/policy/modules/services/podman.te b/policy/modules/services/podman.te index e5158720..f8600a7a 100644 --- a/policy/modules/services/podman.te +++ b/policy/modules/services/podman.te @@ -175,6 +175,9 @@ fs_watch_cgroup_files(podman_conmon_t) fs_getattr_tmpfs(podman_conmon_t) fs_getattr_xattr_fs(podman_conmon_t) +init_rw_inherited_stream_socket(podman_conmon_t) +init_use_fds(podman_conmon_t) + logging_send_syslog_msg(podman_conmon_t) miscfiles_read_localization(podman_conmon_t)
