[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/roles/, policy/modules/system/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     8e5c3ef52981f7fe7a093add0ea2e774c4a03367
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Thu Dec 23 14:54:00 2021 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan 30 01:12:42 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=8e5c3ef5

staff, unconfined: allow container user access

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/roles/staff.te       | 4 ++++
 policy/modules/system/unconfined.te | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 253869d9..4a4867f7 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -23,6 +23,10 @@ optional_policy(`
 	auditadm_role_change(staff_r)
 ')
 
+optional_policy(`
+	container_user_role(staff, staff_t, staff_application_exec_domain, staff_r)
+')
+
 optional_policy(`
 	dbadm_role_change(staff_r)
 ')

diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
index e30a1197..df6fbdb7 100644
--- a/policy/modules/system/unconfined.te
+++ b/policy/modules/system/unconfined.te
@@ -80,6 +80,10 @@ optional_policy(`
 	bootloader_run(unconfined_t, unconfined_r)
 ')
 
+optional_policy(`
+	container_user_role(unconfined, unconfined_t, unconfined_application_exec_domain, unconfined_r)
+')
+
 optional_policy(`
 	cron_unconfined_role(unconfined, unconfined_t, unconfined_application_exec_domain, unconfined_r)
 ')