summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorVictor Nguyen -T (victong2 - OTHERWISE PORTAGE at Cisco) <victong2@cisco.com>2018-02-27 18:20:03 +0100
committerDave Barach <openvpp@barachs.net>2018-02-28 14:35:30 +0000
commit3f8562eaab8a6a495debd8480f6ea31c6173d5d9 (patch)
treec3e6a1a0d9f667358f586fb82836c57aac7bc235
parent8c5f67f2b883ad9dcb489ab0eb16e1acbe478926 (diff)
Fix SELinux capabilities. Creating a tap interface with 'tap connect' was returning an error when VPP was launched as a service (tested on CentOS 7.3). Adding 'net_admin' to SELinux capabilities for VPP solves the issue.
Change-Id: Icd0529b49adb86e7b371283a6f39af03816951c5 Signed-off-by: Victor Nguyen <victong2@cisco.com>
-rw-r--r--extras/selinux/vpp-custom.te4
1 files changed, 2 insertions, 2 deletions
diff --git a/extras/selinux/vpp-custom.te b/extras/selinux/vpp-custom.te
index e0a1f64d018..e8ac50e179c 100644
--- a/extras/selinux/vpp-custom.te
+++ b/extras/selinux/vpp-custom.te
@@ -43,9 +43,9 @@ files_tmp_file(vpp_tmp_t)
# vpp local policy
#
-allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin }; # too benefolent
+allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin }; # too benevolent
dontaudit vpp_t self:capability2 block_suspend;
-allow vpp_t self:process { execmem execstack setsched signal }; # too benefolent
+allow vpp_t self:process { execmem execstack setsched signal }; # too benevolent
allow vpp_t self:packet_socket { bind create setopt ioctl };
allow vpp_t self:tun_socket { create relabelto relabelfrom };
allow vpp_t self:udp_socket { create ioctl };