15 lines
464 B
Text
15 lines
464 B
Text
|
type rss_hwm_reset_exec, system_file_type, exec_type, file_type;
|
||
|
|
|
||
|
|
# Start rss_hwm_reset from init.
|
||
|
|
init_daemon_domain(rss_hwm_reset)
|
||
|
|
|
||
|
|
# Search /proc/pid directories.
|
||
|
|
allow rss_hwm_reset domain:dir search;
|
||
|
|
|
||
|
|
# Write to /proc/pid/clear_refs of other processes.
|
||
|
|
# /proc/pid/clear_refs is S_IWUSER, see: fs/proc/base.c
|
||
|
|
allow rss_hwm_reset self:global_capability_class_set { dac_override };
|
||
|
|
|
||
|
|
# Write to /prc/pid/clear_refs.
|
||
|
|
allow rss_hwm_reset domain:file w_file_perms;
|