If Podman starts us, we need to be able to create and use a UNIX domain socket file under ifconfig_var_run_t or container_var_run_t: add the related permissions. The failure reported by Jan would have been fixed by a simple: allow pasta_t ifconfig_var_run_t:sock_file create; but we'll need more than that for actual operation with pesto(1), and to cover all possible cases. Reported-by: Jan Rodák Link: https://github.com/containers/podman/pull/28478 Fixes: 533577008942 ("selinux: Add file context and type enforcement for pesto") Signed-off-by: Stefano Brivio --- contrib/selinux/pasta.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index fb51416..ff74dd7 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -253,6 +253,8 @@ allow pasta_t container_var_run_t:dir { add_name open rmdir write }; allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write }; allow pasta_t container_var_run_t:file { create open write }; allow pasta_t ifconfig_var_run_t:file { create open write }; +allow pasta_t container_var_run_t:sock_file { getattr create open read write }; +allow pasta_t ifconfig_var_run_t:sock_file { getattr create open read write }; allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir; # Allow pasta to bind to any port -- 2.43.0