Merge pull request #5660 from craigcomstock/ENT-12446-3/3.21

SELinux: Allow cf-serverd to set its own limits (3.21)
cfengine · Dec 10, 2024 · bd0e1d0 · bd0e1d0
2 parents 9c33300 + d939629
commit bd0e1d0
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/misc/selinux/cfengine-enterprise.te.all b/misc/selinux/cfengine-enterprise.te.all
@@ -341,6 +341,9 @@ allow cfengine_serverd_t unreserved_port_t:tcp_socket name_connect;
 allow cfengine_serverd_t cfengine_var_lib_t:sock_file { getattr write };
 allow cfengine_serverd_t cfengine_hub_t:unix_stream_socket connectto;
 
+# allow cf-serverd to set its own limits, e.g. def.control_server_maxconnections
+allow cfengine_serverd_t self:capability sys_resource;
+
 # TODO: this should not be needed
 allow cfengine_serverd_t ssh_port_t:tcp_socket name_connect;
 allow cfengine_serverd_t proc_xen_t:dir search;