Silence sys_module denials for netmgrd.
netmgrd triggers sys_module denials but the kernel has CONFIG_MODULES=n
so we can ignore these.
Change-Id: I4e9606e7fde608ebf21bcde8e77d2a65416e6f68
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
diff --git a/sepolicy/netmgrd.te b/sepolicy/netmgrd.te
index 795b4be..2d59eda 100644
--- a/sepolicy/netmgrd.te
+++ b/sepolicy/netmgrd.te
@@ -8,6 +8,9 @@
# Starts as (root,radio) changes to (radio,radio)
allow netmgrd self:capability { setuid setgid net_admin net_raw };
+# Triggers a sys_module denial, but kernel has CONFIG_MODULES=n.
+dontaudit netmgrd self:capability sys_module;
+
allow netmgrd self:udp_socket { create ioctl };
allow netmgrd self:netlink_socket create_socket_perms;
allow netmgrd self:netlink_route_socket { create_socket_perms nlmsg_write nlmsg_read };
