Merge pull request #266 from rhatdan/pods

Don't allow containers to read /var/lib/kublet/pods by default
containers · Aug 29, 2023 · bfb44d3 · bfb44d3
2 parents ed30ab0 + 341fb1d
commit bfb44d3
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 2 deletions.
diff --git a/container.fc b/container.fc
@@ -137,7 +137,6 @@ HOME_DIR/\.local/share/containers/storage/volumes/[^/]*/.*	gen_context(system_u:
 
 /var/lib/cni(/.*)?								gen_context(system_u:object_r:container_var_lib_t,s0)
 /var/run/flannel(/.*)?								gen_context(system_u:object_r:container_var_run_t,s0)
-/var/lib/kubelet/pods(/.*)?							gen_context(system_u:object_r:container_file_t,s0)
 /var/log/containers(/.*)?							gen_context(system_u:object_r:container_log_t,s0)
 /var/log/pods(/.*)?								gen_context(system_u:object_r:container_log_t,s0)
 

diff --git a/container.te b/container.te
@@ -1,4 +1,4 @@
-policy_module(container, 2.221.0)
+policy_module(container, 2.221.1)
 
 gen_require(`
 	class passwd rootok;