From 524ca27d3bc9b3e08d61cc2e5ad7e7c916c5b0d6 Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 12 Aug 2026 11:11:01 +0300 Subject: [PATCH] [container] Allow container engine domains to create own shm Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov --- policy/modules/services/container.te | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te index 385ac1b52e..f8f065442b 100644 --- a/policy/modules/services/container.te +++ b/policy/modules/services/container.te @@ -574,6 +574,7 @@ allow container_engine_domain self:bpf { map_create map_read map_write prog_load allow container_engine_domain self:fd use; allow container_engine_domain self:user_namespace create; allow container_engine_domain self:fifo_file manage_fifo_file_perms; +allow container_engine_domain self:shm create_shm_perms; allow container_engine_domain self:tcp_socket create_stream_socket_perms; allow container_engine_domain self:udp_socket create_socket_perms; allow container_engine_domain self:unix_stream_socket { create_stream_socket_perms connectto };