Currently podman can pass a FD to a DRI device to pasta, leading to AVCs
like this:
avc: denied { read write }
comm="pasta" path="/dev/dri/renderD128"
scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023
tcontext=system_u:object_r:dri_device_t:s0
tclass=chr_file
These are harmless, so dontaudit them
Signed-off-by: Johannes Segitz
---
contrib/selinux/pasta.te | 2 ++
1 file changed, 2 insertions(+)
diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
index fb51416..4bc7dcc 100644
--- a/contrib/selinux/pasta.te
+++ b/contrib/selinux/pasta.te
@@ -262,3 +262,5 @@ if (pasta_bind_all_ports) {
allow pasta_t port_type:tcp_socket { accept getopt name_bind name_connect };
allow pasta_t port_type:udp_socket { accept getopt name_bind };
}
+
+dev_dontaudit_rw_dri(pasta_t)
--
2.53.0