Allow graphical applications work in Wayland

Resolves: rhbz#2248488
zpytela · Nov 8, 2023 · 3348d60 · 3348d60
1 parent 7789075
commit 3348d60
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/policy/modules/contrib/sandboxX.te b/policy/modules/contrib/sandboxX.te
@@ -357,7 +357,8 @@ optional_policy(`
 #
 typeattribute sandbox_web_client_t sandbox_web_type;
 
-allow sandbox_web_client_t sandbox_web_client_t:cap_userns sys_chroot;
+allow sandbox_web_client_t self:user_namespace create;
+allow sandbox_web_client_t self:cap_userns sys_chroot;
 allow sandbox_web_t sandbox_web_client_t:process2 nnp_transition;
 
 selinux_get_fs_mount(sandbox_web_client_t)
@@ -474,6 +475,10 @@ optional_policy(`
 	chrome_domtrans_sandbox(sandbox_web_type)
 ')
 
+optional_policy(`
+	dbus_watch_config(sandbox_web_type)
+')
+
 optional_policy(`
 	mozilla_plugin_rw_sem(sandbox_web_type)
 ')