summaryrefslogtreecommitdiffstats
path: root/extras/selinux/vpp-custom.te
diff options
context:
space:
mode:
authorBilly McFall <bmcfall@redhat.com>2018-03-14 09:34:02 -0400
committerDamjan Marion <dmarion.lists@gmail.com>2018-03-14 18:43:39 +0000
commit1ac36d74210069d574e00e110dae398cae5130a6 (patch)
tree6b508501f3a24dee1255425271768e572618c17c /extras/selinux/vpp-custom.te
parentd1274cb207a48f0142a5a6cbcd22d61c22dbc230 (diff)
VPP-1197: SELinux: 'create tap' (vhost-net backend TAP) fails when
SELinux is enable Update the SELinux Policy to allow management of the new vhost-net backend TAP interface. Change-Id: I2d0633a7fce2ee2a4d6e0008ab13599647c14f42 Signed-off-by: Billy McFall <bmcfall@redhat.com>
Diffstat (limited to 'extras/selinux/vpp-custom.te')
-rw-r--r--extras/selinux/vpp-custom.te2
1 files changed, 2 insertions, 0 deletions
diff --git a/extras/selinux/vpp-custom.te b/extras/selinux/vpp-custom.te
index e8ac50e179c..2cce7471d24 100644
--- a/extras/selinux/vpp-custom.te
+++ b/extras/selinux/vpp-custom.te
@@ -51,6 +51,7 @@ allow vpp_t self:tun_socket { create relabelto relabelfrom };
allow vpp_t self:udp_socket { create ioctl };
allow vpp_t self:unix_dgram_socket { connect create ioctl };
allow vpp_t self:unix_stream_socket { create_stream_socket_perms connectto };
+allow vpp_t self:netlink_route_socket { bind create nlmsg_write read write };
manage_dirs_pattern(vpp_t, vpp_lib_t, vpp_lib_t)
manage_files_pattern(vpp_t, vpp_lib_t, vpp_lib_t)
@@ -92,6 +93,7 @@ dev_rw_userio_dev(vpp_t)
dev_rw_sysfs(vpp_t)
dev_read_cpuid(vpp_t)
dev_rw_vfio_dev(vpp_t)
+dev_rw_vhost( vpp_t )
domain_obj_id_change_exemption(vpp_t)