Allow spc_t domains to set bpf rules on any domain

Signed-off-by: Daniel J Walsh <[email protected]>
containers · Jul 16, 2021 · 4c51e97 · 4c51e97
1 parent 99b40c5
commit 4c51e97
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/container.te b/container.te
@@ -1,4 +1,4 @@
-policy_module(container, 2.163.0)
+policy_module(container, 2.164.0)
 
 gen_require(`
 	class passwd rootok;
@@ -667,6 +667,9 @@ optional_policy(`
 optional_policy(`
 	unconfined_domain_noaudit(spc_t)
 	domain_ptrace_all_domains(spc_t)
+	// This should eventually be in upstream policy.
+	// https://github.com/fedora-selinux/selinux-policy/pull/806
+	allow spc_t domain:bpf { map_create map_read map_write prog_load prog_run };
 ')
 
 optional_policy(`