We want to allow containers to do anything with the network

From an SELinux point of view. processes access to the network should be controlled by other parts of the system, namely the network namespace and the iptables. Signed-off-by: Daniel J Walsh <[email protected]>
containers · Aug 9, 2019 · 4f7d6bb · 4f7d6bb
1 parent b68cf19
commit 4f7d6bb
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-2.112.0
+2.113.0
diff --git a/container.te b/container.te
@@ -1,4 +1,4 @@
-policy_module(container, 2.112.0)
+policy_module(container, 2.113.0)
 gen_require(`
 	class passwd rootok;
 ')
@@ -793,6 +793,8 @@ tunable_policy(`virt_sandbox_use_sys_admin',`
 allow container_domain self:cap_userns sys_admin;
 allow container_domain self:process { getsession execstack execmem };
 
+corenet_unconfined(container_t)
+
 virt_default_capabilities(container_t)
 kernel_rw_rpc_sysctls(container_domain)
 kernel_rw_net_sysctls(container_domain)