Merge pull request #250 from rhatdan/spc_t

Fix spc_t transitions from container_runtime_domain
containers · May 30, 2023 · a1317a1 · a1317a1
2 parents e16876e + a1a96a2
commit a1317a1
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/container.te b/container.te
@@ -1,4 +1,4 @@
-policy_module(container, 2.215.0)
+policy_module(container, 2.216.0)
 
 gen_require(`
 	class passwd rootok;
@@ -722,7 +722,8 @@ domtrans_pattern(container_runtime_domain, container_var_lib_t, spc_t)
 domtrans_pattern(container_runtime_domain, fusefs_t, spc_t)
 fs_tmpfs_filetrans(spc_t, container_file_t, { dir file lnk_file })
 
-allow container_runtime_domain spc_t:process2 nnp_transition;
+allow container_runtime_domain spc_t:process2 { nnp_transition nosuid_transition };
+
 admin_pattern(spc_t, kubernetes_file_t)
 
 allow spc_t container_runtime_domain:fifo_file manage_fifo_file_perms;