>From 24e6ca2262e1fa9114fb80b5d2f32205379d3a97 Mon Sep 17 00:00:00 2001 From: Nathan Kinder Date: Fri, 11 Dec 2009 10:04:36 -0800 Subject: [PATCH] Allow dirsrv_t to have fsetid capability I ran into an SELinux violation during some testing. This patch allows ns-slapd to have the fsetid capability on itself, which eliminates the AVC. --- selinux/dirsrv.te | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/selinux/dirsrv.te b/selinux/dirsrv.te index ef09fb2..1880e6f 100644 --- a/selinux/dirsrv.te +++ b/selinux/dirsrv.te @@ -86,7 +86,7 @@ allow dirsrv_t self:fifo_file { read write }; # process stuff allow dirsrv_t self:process { getsched setsched setfscreate signal_perms}; -allow dirsrv_t self:capability { sys_nice setuid setgid chown dac_override fowner }; +allow dirsrv_t self:capability { sys_nice setuid setgid fsetid chown dac_override fowner }; # semaphores allow dirsrv_t self:sem all_sem_perms; -- 1.6.2.5