Add a service which applies custom SELinux fixes

openshift · Feb 22, 2023 · 0de5a8a · 0de5a8a
1 parent 97e6cf2
commit 0de5a8a
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 0 deletions.
diff --git a/overlay.d/99okd/usr/lib/okd/selinux-fixes.cil b/overlay.d/99okd/usr/lib/okd/selinux-fixes.cil
@@ -0,0 +1 @@
+allow iptables_t container_runtime_tmpfs_t:chr_file { read write };
diff --git a/overlay.d/99okd/usr/lib/systemd/system-preset/00-okd.preset b/overlay.d/99okd/usr/lib/systemd/system-preset/00-okd.preset
@@ -8,3 +8,5 @@ enable fix-resolv-conf-coredns.service
 disable coreos-check-cgroups.service
 # Enable ovirt service
 enable qemu-guest-agent.service
+# Add custom SELinux rules
+enable okd-selinux.service
diff --git a/overlay.d/99okd/usr/lib/systemd/system/okd-selinux.service b/overlay.d/99okd/usr/lib/systemd/system/okd-selinux.service
@@ -0,0 +1,6 @@
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/semodule -i /usr/lib/okd/selinux-fixes.cil
+RemainAfterExit=yes
+[Install]
+WantedBy=multi-user.target