diff options
| -rw-r--r-- | policy/modules/services/container.if | 20 | ||||
| -rw-r--r-- | policy/modules/system/iptables.te | 5 |
2 files changed, 23 insertions, 2 deletions
diff --git a/policy/modules/services/container.if b/policy/modules/services/container.if index c9f4aa93..902c31b8 100644 --- a/policy/modules/services/container.if +++ b/policy/modules/services/container.if @@ -482,6 +482,26 @@ interface(`container_search_engine_tmp',` ######################################## ## <summary> +## Allow the specified domain to read +## container engine temporary files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`container_read_engine_tmp_files',` + gen_require(` + type container_engine_tmp_t; + ') + + container_search_engine_tmp($1) + allow $1 container_engine_tmp_t:file read_file_perms; +') + +######################################## +## <summary> ## Allow the specified domain to manage ## container engine temporary files. ## </summary> diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te index 684d91a2..7c401fa5 100644 --- a/policy/modules/system/iptables.te +++ b/policy/modules/system/iptables.te @@ -105,11 +105,12 @@ sysnet_dns_name_resolve(iptables_t) userdom_use_inherited_user_terminals(iptables_t) - - optional_policy(` # iptables may try to rw /ptmx in a container container_dontaudit_rw_chr_files(iptables_t) + + # iptables reads firewall rules written to tmp + container_read_engine_tmp_files(iptables_t) ') optional_policy(` |