From e468016b1bd79b505e62fd410f59a03bad8bbe06 Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Tue, 19 Feb 2013 13:17:38 -0500
Subject: [PATCH] zygote requires setpcap in order to drop from its bounding
 set.

I8560fa5ad125bf31f0d13be513431697bc7d22bb changed the zygote
to limit the bounding capability set to CAP_NET_RAW.  This triggers
a CAP_SETPCAP check by the kernel, which requires SELinux setpcap permission.

Change-Id: Ib910d97dcf708273e2806e2824f4abe9fc239d6d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
 zygote.te | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/zygote.te b/zygote.te
index 3350ce343..743af36d4 100644
--- a/zygote.te
+++ b/zygote.te
@@ -6,6 +6,8 @@ init_daemon_domain(zygote)
 typeattribute zygote mlstrustedsubject;
 # Override DAC on files and switch uid/gid.
 allow zygote self:capability { dac_override setgid setuid };
+# Drop capabilities from bounding set.
+allow zygote self:capability setpcap;
 # Switch SELinux context to app domains.
 allow zygote system:process dyntransition;
 allow zygote appdomain:process dyntransition;