Merge pull request #852 from uudiin/secadm

userdomain: allow grant mac_admin capability to security admin
SELinuxProject · Jan 21, 2025 · b9520be · b9520be
2 parents 0b0de5a + 4e7352b
commit b9520be
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
@@ -1497,6 +1497,7 @@ template(`userdom_admin_user_template',`
 #
 interface(`userdom_security_admin_template',`
 	allow $1 self:capability { dac_override dac_read_search };
+	allow $1 self:capability2 mac_admin;
 
 	corecmd_exec_shell($1)