selinux-policy: label FIPS binaries

Signed-off-by: Ben Cressey <[email protected]>
bottlerocket-os · Apr 29, 2024 · 2a0f446 · 2a0f446
1 parent 2a871a0
commit 2a0f446
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/packages/selinux-policy/fs.cil b/packages/selinux-policy/fs.cil
@@ -52,10 +52,10 @@
 (filecon "/.*/usr/sbin/wicked.*" file network_exec)
 (filecon "/.*/usr/libexec/wicked/bin/wicked.*" file network_exec)
 (filecon "/.*/usr/lib/systemd/systemd-networkd.*" file network_exec)
-(filecon "/.*/usr/bin/containerd.*" file runtime_exec)
-(filecon "/.*/usr/bin/docker.*" file runtime_exec)
-(filecon "/.*/usr/bin/host-ctr" file runtime_exec)
-(filecon "/.*/usr/bin/runc.*" file runtime_exec)
+(filecon "/.*/usr(/fips)?/bin/containerd.*" file runtime_exec)
+(filecon "/.*/usr(/fips)?/bin/docker.*" file runtime_exec)
+(filecon "/.*/usr(/fips)?/bin/host-ctr" file runtime_exec)
+(filecon "/.*/usr(/fips)?/bin/runc.*" file runtime_exec)
 (filecon "/.*/usr/bin/shibaken" file api_exec)
 
 ; Label local storage mounts.