container_engine_t: another round of small improvements #327
Conversation
|
LGTM |
haircommander
force-pushed
the
engine_t-3
branch
from
bfed6f8
to
d830c32
Compare
|
added one more piece PTAL @rhatdan |
container.te
Outdated
| @@ -1450,11 +1450,13 @@ allow container_engine_t sysctl_t:{dir file} mounton; | |||
| allow container_engine_t fusefs_t:dir { relabelfrom relabelto }; | |||
| allow container_engine_t fusefs_t:file relabelto; | |||
| allow container_engine_t kernel_t:system module_request; | |||
| allow container_engine_t null_device_t:chr_file mounton; | |||
| allow container_engine_t null_device_t:chr_file { mounton setattr }; | |||
There was a problem hiding this comment.
allow container_engine_t null_device_t:chr_file { mounton setattr_chr_file_perms };
container.te
Outdated
| allow container_engine_t random_device_t:chr_file mounton; | ||
| allow container_engine_t self:netlink_tcpdiag_socket nlmsg_read; | ||
| allow container_engine_t urandom_device_t:chr_file mounton; | ||
| allow container_engine_t zero_device_t:chr_file mounton; | ||
| allow container_engine_t container_file_t:sock_file mounton; | ||
| allow container_engine_t container_runtime_tmpfs_t:dir ioctl; |
There was a problem hiding this comment.
allow container_engine_t container_runtime_tmpfs_t:dir list_dir_perms;
There was a problem hiding this comment.
AVCs often come in pairs and show up later in testing or use, so it is always better to be a little less tight.
Signed-off-by: Peter Hunt <pehunt@redhat.com>
haircommander
force-pushed
the
engine_t-3
branch
from
d830c32
to
ff1d5ee
Compare
|
updated! PTAL |
|
Ephemeral COPR build failed. @containers/packit-build please check. |
|
Tests failed. @containers/packit-build please check. |
|
LGTM |
|
Ephemeral COPR build failed. @containers/packit-build please check. |
|
Tests failed. @containers/packit-build please check. |
|
problem is at https://pagure.io/fedora-infrastructure/issue/12183 |
|
/packit build Ignore f41 and rawhide for now. I guess f39 can be ignored too unless it's critical |
I removed f41 and rawhide tests from the status check list for now. Feel free to remove others if those are blocking on unrelated issues. |
|
Ephemeral COPR build failed. @containers/packit-build please check. |
|
Tests failed. @containers/packit-build please check. |
|
The test failures are because of f39 and el9 disablement on podman-next copr . I'm disabling those targets in #330 |
|
@rhatdan good to merge? |
No description provided.