[PATCH 4/6] selinux/passt.te: Allow setcap on the process itself

This is needed by the new functions in isolate.c, add the corresponding rule. Signed-off-by: Stefano Brivio --- contrib/selinux/passt.te | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index 12a4288..45d56c2 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -90,6 +90,7 @@ allow passt_t user_devpts_t:chr_file { getattr read write ioctl }; logging_send_syslog_msg(passt_t) allow syslogd_t self:cap_userns sys_ptrace; +allow passt_t self:process setcap; allow passt_t self:capability { sys_tty_config setpcap net_bind_service }; allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace }; -- 2.39.1