[selinux-policy][PATCH] Allow sanlock to use sys_resource and setrlimit

Federico Simoncelli fsimonce at redhat.com
Fri Aug 3 07:50:17 UTC 2012


In a recent change (git:789aca6) sanlock added two setrlimit calls.

Signed-off-by: Federico Simoncelli <fsimonce at redhat.com>
---
 policy/modules/services/sanlock.te | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/policy/modules/services/sanlock.te b/policy/modules/services/sanlock.te
index e9c2efe..fdb1b82 100644
--- a/policy/modules/services/sanlock.te
+++ b/policy/modules/services/sanlock.te
@@ -44,8 +44,8 @@ ifdef(`enable_mls',`
 #
 # sanlock local policy
 #
-allow sanlock_t self:capability { chown setgid dac_override ipc_lock sys_nice };
-allow sanlock_t self:process { setsched signull signal sigkill };
+allow sanlock_t self:capability { chown setgid dac_override ipc_lock sys_nice sys_resource };
+allow sanlock_t self:process { setsched signull signal sigkill setrlimit };
 
 allow sanlock_t self:fifo_file rw_fifo_file_perms;
 allow sanlock_t self:unix_stream_socket create_stream_socket_perms;
-- 
1.7.11.2



More information about the sanlock-devel mailing list