On 4/13/21 07:16, Remi Malessa wrote:
This is what he said:
"(..)so I used the tool and flags “audit2allow -a -w” this showed me the issues that were denying based on the SELinux baseline for the box. From here you can follow the recommendations (the setbool command I mentioned) and also you can use “audit2allow -a -M somepolicy” to create a policy to install (you do this using semodule -i somepolicy.pp)
In our case I could apply this as there were only those rules to apply, but you would probably want to be more granular on most systems for example:
grep yourService /var/log/audit/audit.log | audit2allow -M anotherPolicy && semodule –i anotherPolicy.pp(...)" _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
I would just turn on the boolean. If you see more AVCs about container_t then you should report them as issues on container-selinux.