Allow jellyfin to map/execute tmpfs_t

karuboniru · May 12, 2024 · e72ff1a · e72ff1a
1 parent 753d0c1
commit e72ff1a
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/cils/container_jellyfin.cil b/cils/container_jellyfin.cil
@@ -0,0 +1,9 @@
+(block container_jellyfin
+    (blockinherit container)
+    (blockinherit net_container)
+
+    (allow process user_home_t ( dir ( watch getattr ioctl lock open read search ))) 
+    (allow process user_home_t ( file ( watch getattr ioctl lock open read ))) 
+
+    (allow process tmpfs_t (file (execute map)))
+)
diff --git a/server.yaml b/server.yaml
@@ -265,6 +265,7 @@ add-files:
       "/etc/cils/container_rwhome_allbind.cil",
     ],
     ["cils/container_wireguard.cil", "/etc/cils/container_wireguard.cil"],
+    ["cils/container_jellyfin.cil", "/etc/cils/container_jellyfin.cil"],
     ["etc/containers/containers.conf", "/etc/containers/containers.conf"],
     ["etc/containers/storage.conf", "/etc/containers/storage.conf"],
     [