From 4915661dd8cb1af02edd7a26da1fd554bab00376 Mon Sep 17 00:00:00 2001 From: Kris Lamoureux Date: Tue, 8 Sep 2026 16:57:57 -0400 Subject: [PATCH] Allow execmod for Bitwarden's mssql container --- roles/bitwarden/files/bitwarden.te | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/bitwarden/files/bitwarden.te b/roles/bitwarden/files/bitwarden.te index c41ffb7..52ad152 100644 --- a/roles/bitwarden/files/bitwarden.te +++ b/roles/bitwarden/files/bitwarden.te @@ -2,8 +2,10 @@ module bitwarden 1.0; require { type container_t; + type container_file_t; type container_ro_file_t; type oci_log_t; + type unconfined_t; class process ptrace; class file { read getattr open lock ioctl write append create unlink setattr rename link map execmod }; class dir { read getattr search open lock ioctl write add_name remove_name create rmdir setattr rename reparent }; @@ -11,7 +13,9 @@ require { } allow container_t self:process ptrace; +allow container_t container_file_t:file execmod; allow container_t container_ro_file_t:file execmod; +allow unconfined_t container_ro_file_t:file execmod; allow container_t oci_log_t:dir { read getattr search open lock ioctl write add_name remove_name create rmdir setattr rename reparent }; allow container_t oci_log_t:file { read getattr open lock ioctl write append create unlink setattr rename link map }; allow container_t oci_log_t:lnk_file { read getattr create unlink rename };