Merge pull request #812 from dsugar100/mta_optional_in_container

Make mta optional in container policy
SELinuxProject · Oct 1, 2024 · b750fd4 · b750fd4
2 parents 226a1be + c0e8cfb
commit b750fd4
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te
@@ -391,8 +391,6 @@ miscfiles_dontaudit_setattr_fonts_cache_dirs(container_domain)
 miscfiles_read_fonts(container_domain)
 miscfiles_read_generic_certs(container_domain)
 
-mta_dontaudit_read_spool_symlinks(container_domain)
-
 container_rw_device_files(container_domain)
 container_use_container_ptys(container_domain)
 
@@ -456,6 +454,10 @@ optional_policy(`
 	kubernetes_watch_tmpfs_files(container_domain)
 ')
 
+optional_policy(`
+	mta_dontaudit_read_spool_symlinks(container_domain)
+')
+
 optional_policy(`
 	podman_rw_conmon_pipes(container_domain)
 	podman_use_conmon_fds(container_domain)