On Fedora 41, without "allow pasta_t unconfined_t:dir read" /usr/bin/pasta
can't open /proc/[pid]/ns , which is required by pasta_netns_quit_init() .
This patch also remove one duplicate rule "allow pasta_t nsfs_t:file read;" ,
"allow pasta_t nsfs_t:file { open read };" at line 123 is enough.
---
contrib/selinux/pasta.te | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
index 69be081..d0ff0cc 100644
--- a/contrib/selinux/pasta.te
+++ b/contrib/selinux/pasta.te
@@ -171,7 +171,7 @@ allow pasta_t init_t:lnk_file read;
allow pasta_t init_t:unix_stream_socket connectto;
allow pasta_t init_t:dbus send_msg;
allow pasta_t init_t:system status;
-allow pasta_t unconfined_t:dir search;
+allow pasta_t unconfined_t:dir { read search };
allow pasta_t unconfined_t:file read;
allow pasta_t unconfined_t:lnk_file read;
allow pasta_t self:process { setpgid setcap };
@@ -192,8 +192,6 @@ allow pasta_t sysctl_net_t:dir search;
allow pasta_t sysctl_net_t:file { open read write };
allow pasta_t kernel_t:system module_request;
-allow pasta_t nsfs_t:file read;
-
allow pasta_t proc_t:dir mounton;
allow pasta_t proc_t:filesystem mount;
allow pasta_t net_conf_t:lnk_file read;
--