AimeeOS
/
aimee-os
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

SELinux: Allow Podman to relabel any file 

The default SELinux policy for Podman only allows it to relabel certain
files, such as `user_home_t`, to `container_file_t`.  This effectively
precludes mounting arbitrary directories from `/var` into containers.
gentoo
Dustin 2023-03-26 12:13:09 -05:00
parent 5328e5482b
commit d6580cfdf4
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
repos/aimee-os/sec-policy/selinux-aimee-os/files/aimee-os.te
View File

@ -238,3 +238,12 @@ gen_require(`
type sysadm_t; type sysadm_t;
') ')
init_use_fds(sysadm_t) init_use_fds(sysadm_t)
# Allow podman to relabel any file (to container_file_t)
optional_policy(`
gen_require(`
type podman_t;
')
files_relabel_non_security_dirs(podman_t)
files_relabel_non_security_files(podman_t)
')