particle-os/debian-forge
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

selinux: Allow unconfined_service_t → osbuild_t

Browse source 
When osbuild is invoked via the osbuild composer worker, the latter
is run in the unconfined_service_t domain, so add a rule that
allows that transition.
This commit is contained in:
Christian Kellner 2020-06-09 20:08:06 +02:00 • committed by Tom Gundersen
parent a419ee9038
commit 65e1b35102
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
selinux/osbuild.te
View file

@ -51,6 +51,15 @@ optional_policy(`
osbuild_run(unconfined_t, unconfined_r) osbuild_run(unconfined_t, unconfined_r)
') ')
optional_policy(`
gen_require(`
type unconfined_service_t;
role system_r;
')
osbuild_run(unconfined_service_t, system_r)
')
# allow transitioning to install_t (for ostree) # allow transitioning to install_t (for ostree)
optional_policy(` optional_policy(`
anaconda_domtrans_install(osbuild_t) anaconda_domtrans_install(osbuild_t)