[selinux-policy][PATCH] Allow sanlock to use sys_resource and setrlimit

[Federico Simoncelli]

In a recent change (git:789aca6) sanlock added two setrlimit calls.

Signed-off-by: Federico Simoncelli <fsimonce(a)redhat.com&gt;
---
 policy/modules/services/sanlock.te | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/policy/modules/services/sanlock.te b/policy/modules/services/sanlock.te
index e9c2efe..fdb1b82 100644
--- a/policy/modules/services/sanlock.te
+++ b/policy/modules/services/sanlock.te
@@ -44,8 +44,8 @@ ifdef(`enable_mls',`
 #
 # sanlock local policy
 #
-allow sanlock_t self:capability { chown setgid dac_override ipc_lock sys_nice };
-allow sanlock_t self:process { setsched signull signal sigkill };
+allow sanlock_t self:capability { chown setgid dac_override ipc_lock sys_nice
sys_resource };
+allow sanlock_t self:process { setsched signull signal sigkill setrlimit };
 
 allow sanlock_t self:fifo_file rw_fifo_file_perms;
 allow sanlock_t self:unix_stream_socket create_stream_socket_perms;
-- 
1.7.11.2