30 lines
1.1 KiB
Diff
30 lines
1.1 KiB
Diff
From db12459fc6360763f7358adff0026577f2d51261 Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Tue, 31 May 2022 19:51:21 +0200
|
|
Subject: [PATCH] Allow iscsid the sys_ptrace userns capability
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/db12459fc6360763f7358adff0026577f2d51261
|
|
Conflict: NA
|
|
|
|
Resolves: rhbz#2086871
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/contrib/iscsi.te | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/policy/modules/contrib/iscsi.te b/policy/modules/contrib/iscsi.te
|
|
index 76a7607..5bcf209 100644
|
|
--- a/policy/modules/contrib/iscsi.te
|
|
+++ b/policy/modules/contrib/iscsi.te
|
|
@@ -36,6 +36,7 @@ files_pid_file(iscsi_var_run_t)
|
|
#
|
|
|
|
allow iscsid_t self:capability { dac_read_search ipc_lock net_admin net_raw sys_admin sys_nice sys_module sys_resource };
|
|
+allow iscsid_t self:cap_userns sys_ptrace;
|
|
allow iscsid_t self:process { setrlimit setsched signal };
|
|
allow iscsid_t self:fifo_file rw_fifo_file_perms;
|
|
allow iscsid_t self:unix_stream_socket { accept connectto listen };
|
|
--
|
|
1.8.3.1
|
|
|