etc: SELinux: Allow init process to setattr on profile directories.

* etc/guix-daemon.cil.in: Add rule.

diff --git a/etc/guix-daemon.cil.in b/etc/guix-daemon.cil.in
index 0245c36..f55ef22 100644 (file)
--- a/etc/guix-daemon.cil.in
+++ b/etc/guix-daemon.cil.in
@@ -94,6 +94,9 @@
   (allow init_t
          guix_store_content_t
          (file (open read execute)))
+  (allow init_t
+         guix_profiles_t
+         (dir (setattr)))
 
   ;; guix-daemon needs to know the names of users
   (allow guix_daemon_t