kris/homelab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Allow execmod for Bitwarden's mssql container

Browse Source
This commit is contained in:
kris
2026-09-08 16:57:57 -04:00
parent 0548cb8a5e
commit 4915661dd8
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/bitwarden/files/bitwarden.te
+4
View File
@@ -2,8 +2,10 @@ module bitwarden 1.0;
require { require {
type container_t; type container_t;
type container_file_t;
type container_ro_file_t; type container_ro_file_t;
type oci_log_t; type oci_log_t;
type unconfined_t;
class process ptrace; class process ptrace;
class file { read getattr open lock ioctl write append create unlink setattr rename link map execmod }; class file { read getattr open lock ioctl write append create unlink setattr rename link map execmod };
class dir { read getattr search open lock ioctl write add_name remove_name create rmdir setattr rename reparent }; class dir { read getattr search open lock ioctl write add_name remove_name create rmdir setattr rename reparent };
@@ -11,7 +13,9 @@ require {
} }
allow container_t self:process ptrace; allow container_t self:process ptrace;
allow container_t container_file_t:file execmod;
allow container_t container_ro_file_t:file execmod; allow container_t container_ro_file_t:file execmod;
allow unconfined_t container_ro_file_t:file execmod;
allow container_t oci_log_t:dir { read getattr search open lock ioctl write add_name remove_name create rmdir setattr rename reparent }; allow container_t oci_log_t:dir { read getattr search open lock ioctl write add_name remove_name create rmdir setattr rename reparent };
allow container_t oci_log_t:file { read getattr open lock ioctl write append create unlink setattr rename link map }; allow container_t oci_log_t:file { read getattr open lock ioctl write append create unlink setattr rename link map };
allow container_t oci_log_t:lnk_file { read getattr create unlink rename }; allow container_t oci_log_t:lnk_file { read getattr create unlink rename };