;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl>
;; SPDX-License-Identifier: Unlicense

(block cgroup
    (filecon "/sys/fs/cgroup" dir fs_context)
    (filecon "/sys/fs/cgroup/.*" any ())

    (allow fs self (filesystem (associate)))

    (call .rbacsep.exempt.obj.type (fs))

    (call .sys.associate_fs (fs))
    
    (genfscon "cgroup" "/" fs_context)
    (genfscon "cgroup2" "/" fs_context)

    (blockinherit .fs.macro_template_dirs)
    (blockinherit .fs.macro_template_files)
    (blockinherit .seclabelfs.template))