Fix iptables to be able to run in unconfined role

Signed-off-by: Daniel J Walsh <[email protected]>
containers · May 11, 2023 · 4aa3fc7 · 4aa3fc7
1 parent c9cac6c
commit 4aa3fc7
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/container.te b/container.te
@@ -390,7 +390,10 @@ optional_policy(`
 ')
 
 optional_policy(`
-	iptables_domtrans(container_runtime_domain)
+	gen_require(`
+		role unconfined_r;
+	')
+	iptables_run(container_runtime_domain, unconfined_r)
 
 	container_read_pid_files(iptables_t)
 	container_read_state(iptables_t)