From db12459fc6360763f7358adff0026577f2d51261 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 31 May 2022 19:51:21 +0200 Subject: [PATCH] Allow iscsid the sys_ptrace userns capability Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/db12459fc6360763f7358adff0026577f2d51261 Conflict: NA Resolves: rhbz#2086871 Signed-off-by: lujie54 --- policy/modules/contrib/iscsi.te | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/contrib/iscsi.te b/policy/modules/contrib/iscsi.te index 76a7607..5bcf209 100644 --- a/policy/modules/contrib/iscsi.te +++ b/policy/modules/contrib/iscsi.te @@ -36,6 +36,7 @@ files_pid_file(iscsi_var_run_t) # allow iscsid_t self:capability { dac_read_search ipc_lock net_admin net_raw sys_admin sys_nice sys_module sys_resource }; +allow iscsid_t self:cap_userns sys_ptrace; allow iscsid_t self:process { setrlimit setsched signal }; allow iscsid_t self:fifo_file rw_fifo_file_perms; allow iscsid_t self:unix_stream_socket { accept connectto listen }; -- 1.8.3.1