Allow dac_override to groupadd_t domain BZ(1497081)

pmatilai · Sep 29, 2017 · 0651cc9 · 0651cc9
1 parent 53198cb
commit 0651cc9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
@@ -495,7 +495,7 @@ optional_policy(`
 # Useradd local policy
 #
 
-allow useradd_t self:capability { dac_read_search  chown kill fowner fsetid setuid sys_ptrace sys_resource sys_chroot };
+allow useradd_t self:capability { dac_read_search dac_override chown kill fowner fsetid setuid sys_ptrace sys_resource sys_chroot };
 
 dontaudit useradd_t self:capability { net_admin sys_tty_config };
 dontaudit useradd_t self:cap_userns { sys_ptrace };