diff --git a/container.te b/container.te index 56de216..a088930 100644 --- a/container.te +++ b/container.te @@ -38,6 +38,13 @@ gen_tunable(sshd_launch_containers, false) ## gen_tunable(container_use_devices, false) +## +##

+## Allow containers to use any xserver device volume mounted into container, mostly used for GPU acceleration +##

+##
+gen_tunable(container_use_xserver_devices, false) + ## ##

## Allow containers to use any dri device volume mounted into container @@ -1395,6 +1402,11 @@ tunable_policy(`container_use_devices',` allow container_domain device_node:blk_file {rw_blk_file_perms map}; ') +tunable_policy(`container_use_xserver_devices',` + dev_getattr_xserver_misc_dev(container_t) + dev_rw_xserver_misc(container_t) +') + tunable_policy(`container_use_dri_devices',` dev_rw_dri(container_domain) ')