make fapolicyd-hardening module optional

Signed-off-by: Renaud Métrich <[email protected]>
linux-application-whitelisting · Jan 15, 2024 · 1f736b8 · 1f736b8
1 parent 088ba94
commit 1f736b8
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/fapolicyd-hardening.cil b/fapolicyd-hardening.cil
@@ -1 +1,4 @@
-(deny domain fapolicyd_t ( process ( ptrace sigkill sigstop ) ) )
+(optional fapolicyd_hardening_optional
+    (typeattributeset cil_gen_require fapolicyd_t)
+    (deny domain fapolicyd_t ( process ( ptrace sigkill sigstop ) ) )
+)