commit: 9db82cfc59aa9ff8c525adf9f378d415177d91eb
Author: Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Thu Mar 31 18:18:55 2022 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Apr 9 19:28:30 2022 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=9db82cfc
podman: allow system podman to interact with container transient units
Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/services/podman.te | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/policy/modules/services/podman.te
b/policy/modules/services/podman.te
index 5df45d32..316db505 100644
--- a/policy/modules/services/podman.te
+++ b/policy/modules/services/podman.te
@@ -66,6 +66,10 @@ ifdef(`init_systemd',`
init_start_system(podman_t)
init_stop_system(podman_t)
+ # containers get created as systemd transient units
+ init_get_transient_units_status(podman_t)
+ init_start_transient_units(podman_t)
+
# podman can read logs from containers which are
# sent to the system journal
logging_search_logs(podman_t)
