diff --git a/netd.te b/netd.te index 5f4f38cb70c6c1098c4ae941d3f9e0aa55826ca8..f84b45279e5ceeb3918ad48ebf23ac0fb81194b7 100644 --- a/netd.te +++ b/netd.te @@ -11,9 +11,8 @@ allow netd self:capability { net_admin net_raw kill }; # than one of the groups assigned to the current process to see if # the setgid bit should be cleared, regardless of whether the setgid # bit was even set. We do not appear to truly need this capability -# for netd to operate. Uncomment the dontaudit rule below after -# sufficient testing of the fsetid removal. -# dontaudit netd self:capability fsetid; +# for netd to operate. +dontaudit netd self:capability fsetid; allow netd self:netlink_kobject_uevent_socket create_socket_perms; allow netd self:netlink_route_socket nlmsg_write;