Allow sysadm_t and user_t SELinux users to mmap mandb_cache_t domain

filbranden · Dec 16, 2018 · 2dc64e3 · 2dc64e3
1 parent 85649d0
commit 2dc64e3
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
@@ -339,6 +339,10 @@ optional_policy(`
 	lvm_run(sysadm_t, sysadm_r)
 ')
 
+optional_policy(`
+    mandb_map_cache_files(sysadm_t)
+')
+
 optional_policy(`
 	modutils_run_depmod(sysadm_t, sysadm_r)
 	modutils_run_insmod(sysadm_t, sysadm_r)

diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
@@ -78,6 +78,10 @@ optional_policy(`
 	oident_relabel_user_content(user_t)
 ')
 
+optional_policy(`
+    mandb_map_cache_files(user_t)
+')
+
 optional_policy(`
 	mozilla_run_plugin(user_t, user_r)
 ')