diff --git a/policy/constraints b/policy/constraints index d70f3ed..fe7cf0f 100644 --- a/policy/constraints +++ b/policy/constraints @@ -1,3 +1,4 @@ + # # Define the constraints # @@ -90,7 +91,7 @@ constrain process { transition noatsecure siginh rlimitinh } ( u1 == u2 or ( t1 == can_change_process_identity and t2 == process_user_target ) - or ( t1 == cron_source_domain and ( t2 == cron_job_domain or u2 == system_u ) ) + or ( t1 == cron_source_domain and ( t2 == cron_job_domain or u2 == system_u ) ) or ( t1 == can_system_change and u2 == system_u ) or ( t1 == process_uncond_exempt ) );