1type rss_hwm_reset_exec, system_file_type, exec_type, file_type;
2
3# Start rss_hwm_reset from init.
4init_daemon_domain(rss_hwm_reset)
5
6# Search /proc/pid directories.
7allow rss_hwm_reset domain:dir search;
8
9# Write to /proc/pid/clear_refs of other processes.
10# /proc/pid/clear_refs is S_IWUSER, see: fs/proc/base.c
11allow rss_hwm_reset self:global_capability_class_set { dac_override };
12
13# Write to /prc/pid/clear_refs.
14allow rss_hwm_reset domain:file w_file_perms;
15