Allow containers to use fifo files handed to them by users

Signed-off-by: Daniel J Walsh <[email protected]>
containers · Jul 9, 2020 · 9884317 · 9884317
1 parent 6b721da
commit 9884317
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/container.te b/container.te
@@ -1,4 +1,4 @@
-policy_module(container, 2.137.0)
+policy_module(container, 2.138.0)
 gen_require(`
 	class passwd rootok;
 ')
@@ -538,6 +538,7 @@ optional_policy(`
 	unconfined_domain(container_runtime_t)
 	unconfined_run_to(container_runtime_t, container_runtime_exec_t)
 	role_transition unconfined_r container_runtime_exec_t system_r;
+	allow container_domain unconfined_t:fifo_file { rw_fifo_file_perms map };
 	allow container_runtime_domain unconfined_t:fifo_file setattr;
 	allow unconfined_t container_domain:process dyntransition;
 	allow unconfined_t unlabeled_t:key manage_key_perms;