Allow spc_t domains to set bpf rules on any domain

Signed-off-by: Daniel J Walsh <[email protected]>

Author: rhatdan

container.te

@@ -1,4 +1,4 @@
-policy_module(container, 2.163.0)
+policy_module(container, 2.164.0)
 
 gen_require(`
 	class passwd rootok;
@@ -667,6 +667,9 @@ optional_policy(`
 optional_policy(`
 	unconfined_domain_noaudit(spc_t)
 	domain_ptrace_all_domains(spc_t)
+	// This should eventually be in upstream policy.
+	// https://github.com/fedora-selinux/selinux-policy/pull/806
+	allow spc_t domain:bpf { map_create map_read map_write prog_load prog_run };
 ')
 
 optional_policy(`