sec-policy/selinux-unconfined: add flatcar patch

this patch set torcx-generator to unconfined type. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
flatcar-archive · Aug 16, 2022 · afe2625 · afe2625
1 parent 746b01f
commit afe2625
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/sec-policy/selinux-unconfined/files/torcx.patch b/sec-policy/selinux-unconfined/files/torcx.patch
@@ -0,0 +1,10 @@
+diff --git a/policy/modules/system/unconfined.fc b/policy/modules/system/unconfined.fc
+index 075d51aa3..cad3c8ab0 100644
+--- a/system/unconfined.fc
++++ b/system/unconfined.fc
+@@ -24,3 +24,5 @@ ifdef(`distro_debian',`
+ ifdef(`distro_gentoo',`
+ /usr/lib/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
+ ')
++
++/usr/lib/systemd/system-generators/torcx-generator -- gen_context(system_u:object_r:unconfined_exec_t,s0)
diff --git a/sec-policy/selinux-unconfined/selinux-unconfined-2.20220106-r3.ebuild b/sec-policy/selinux-unconfined/selinux-unconfined-2.20220106-r3.ebuild
@@ -8,6 +8,8 @@ MODS="unconfined"
 
 inherit selinux-policy-2
 
+POLICY_PATCH="${FILESDIR}/torcx.patch"
+
 DESCRIPTION="SELinux policy for unconfined"
 
 if [[ ${PV} != 9999* ]] ; then