diff --git a/container.if b/container.if index 933cb0d..8a7daca 100644 --- a/container.if +++ b/container.if @@ -87,6 +87,25 @@ interface(`container_read_state',` ps_process_pattern($1, container_runtime_t) ') +######################################## +## +## Write to /proc/PID of container runtime. +## This is needed e.g. to set uid_map or gid_map +## +## +## +## Domain allowed access. +## +## +# +interface(`container_write_proc_files',` + gen_require(` + type container_runtime_t; + ') + + allow $1 container_runtime_t:file { open write }; +') + ######################################## ## ## Search container lib directories.