Make mta optional in container policy

Don't need to have mta policy loaded when loading container policy. Signed-off-by: Dave Sugar <[email protected]>
SELinuxProject · Oct 1, 2024 · 79a0e9c · 79a0e9c
1 parent 4b23616
commit 79a0e9c
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te
@@ -391,8 +391,6 @@ miscfiles_dontaudit_setattr_fonts_cache_dirs(container_domain)
 miscfiles_read_fonts(container_domain)
 miscfiles_read_generic_certs(container_domain)
 
-mta_dontaudit_read_spool_symlinks(container_domain)
-
 container_rw_device_files(container_domain)
 container_use_container_ptys(container_domain)
 
@@ -456,6 +454,10 @@ optional_policy(`
 	kubernetes_watch_tmpfs_files(container_domain)
 ')
 
+optional_policy(`
+	mta_dontaudit_read_spool_symlinks(container_domain)
+')
+
 optional_policy(`
 	podman_rw_conmon_pipes(container_domain)
 	podman_use_conmon_fds(container_domain)