#104 - Allow container_t to open existing tun/tap

containers · Sep 10, 2020 · fc69960 · fc69960
1 parent 5d929d4
commit fc69960
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/container.te b/container.te
@@ -1,4 +1,4 @@
-policy_module(container, 2.144.0)
+policy_module(container, 2.145.0)
 gen_require(`
 	class passwd rootok;
 ')
@@ -725,7 +725,7 @@ allow container_domain self:sem create_sem_perms;
 allow container_domain self:shm create_shm_perms;
 allow container_domain self:socket create_socket_perms;
 allow container_domain self:tcp_socket create_socket_perms;
-allow container_domain self:tun_socket create_socket_perms;
+allow container_domain self:tun_socket { create_socket_perms relabelfrom relabelto };
 allow container_domain self:udp_socket create_socket_perms;
 allow container_domain self:unix_dgram_socket create_socket_perms;
 allow container_domain self:unix_stream_socket create_stream_socket_perms;