| Rafal Slawik | 4e1c576 | 2018-11-15 13:04:13 +0000 | [diff] [blame] | 1 | type rss_hwm_reset_exec, system_file_type, exec_type, file_type; |
| 2 | |
| 3 | # Start rss_hwm_reset from init. |
| 4 | init_daemon_domain(rss_hwm_reset) |
| 5 | |
| 6 | # Search /proc/pid directories. |
| 7 | allow rss_hwm_reset domain:dir search; |
| 8 | |
| 9 | # Write to /proc/pid/clear_refs of other processes. |
| 10 | # /proc/pid/clear_refs is S_IWUSER, see: fs/proc/base.c |
| 11 | allow rss_hwm_reset self:global_capability_class_set { dac_override }; |
| 12 | |
| 13 | # Write to /prc/pid/clear_refs. |
| 14 | allow rss_hwm_reset domain:file w_file_perms; |