diff options
| author |   Kenton Groombridge <concord@gentoo.org> | 2024-08-09 15:23:24 -0400 |
|---|---|---|
| committer |   Jason Zaman <perfinion@gentoo.org> | 2024-09-21 15:28:29 -0700 |
| commit | 2e1192a4f76b25a7f91cdda83ffddaea56723119 (patch) | |
| tree | db42a8d5f9dc53d229091f5cf3ee37c268fc0842 /policy/modules/system | |
| parent | container: allow spc various rules for kubevirt (diff) | |
| download | hardened-refpolicy-2e1192a4f76b25a7f91cdda83ffddaea56723119.tar.gz hardened-refpolicy-2e1192a4f76b25a7f91cdda83ffddaea56723119.tar.bz2 hardened-refpolicy-2e1192a4f76b25a7f91cdda83ffddaea56723119.zip | |
iptables: allow reading container engine tmp files
When multus creates a new network, iptables rules get written to /tmp
and iptables will be called to load them.
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
Diffstat (limited to 'policy/modules/system')
| -rw-r--r-- | policy/modules/system/iptables.te | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te index 684d91a2..7c401fa5 100644 --- a/policy/modules/system/iptables.te +++ b/policy/modules/system/iptables.te @@ -105,11 +105,12 @@ sysnet_dns_name_resolve(iptables_t) userdom_use_inherited_user_terminals(iptables_t) - - optional_policy(` # iptables may try to rw /ptmx in a container container_dontaudit_rw_chr_files(iptables_t) + + # iptables reads firewall rules written to tmp + container_read_engine_tmp_files(iptables_t) ') optional_policy(` |