cb0f84fa75
We can iterate on these but this seems to be the minimum required when running selinux as enforcing. Change-Id: Ibfc5b9dee5d6e18ef2460fa4f0060092800ae473
16 lines
489 B
Plaintext
16 lines
489 B
Plaintext
module ara-gunicorn 1.0;
|
|
|
|
require {
|
|
type init_t;
|
|
type user_home_t;
|
|
class file { create execute execute_no_trans ioctl lock map open read write };
|
|
class lnk_file { getattr read };
|
|
}
|
|
|
|
#============= init_t ==============
|
|
|
|
#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
|
|
allow init_t user_home_t:file map;
|
|
allow init_t user_home_t:file { create execute execute_no_trans ioctl lock open read write };
|
|
allow init_t user_home_t:lnk_file { getattr read };
|