Allow containers to execmod files on fusefs_t file systems

Signed-off-by: Daniel J Walsh <[email protected]>
containers · Aug 21, 2019 · fddfbbb · fddfbbb
1 parent 028ab00
commit fddfbbb
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 5 deletions.
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-2.114.0
+2.115.0
diff --git a/container.te b/container.te
@@ -1,4 +1,4 @@
-policy_module(container, 2.114.0)
+policy_module(container, 2.115.0)
 gen_require(`
 	class passwd rootok;
 ')
@@ -873,10 +873,8 @@ fs_mount_fusefs(container_domain)
 fs_unmount_fusefs(container_domain)
 fs_mounton_fusefs(container_domain)
 storage_rw_fuse(container_domain)
-allow container_domain fusefs_t:file mounton;
+allow container_domain fusefs_t:file { mounton execmod };
 allow container_domain fusefs_t:filesystem remount;
-#manage_fifo_files_pattern(container_domain, fusefs_t, fusefs_t)
-#manage_sock_files_pattern(container_domain, fusefs_t, fusefs_t)
 
 tunable_policy(`virt_sandbox_use_netlink',`
 	allow container_t self:netlink_socket create_socket_perms;