summaryrefslogtreecommitdiffstats
path: root/extras/selinux
diff options
context:
space:
mode:
authorBilly McFall <bmcfall@redhat.com>2019-05-16 15:58:58 -0400
committerDave Barach <openvpp@barachs.net>2019-05-31 11:43:26 +0000
commit5b82610cfa1f6d782ce53c2215fbbb2f6a5b755d (patch)
tree508879cc136cf0d7aeec7ac297b8db2aaf160c0b /extras/selinux
parent7e5742f6d6e7dce8ef94d807928ad21839507e0f (diff)
VPP-1679 - SElinux rules are not set accordingly
Updates to the VPP SELinux policy to support the MLX5 DPDK driver. Change-Id: I089ede88a5e9c4152178f8cf9be5ee14d8a9130f Signed-off-by: Billy McFall <bmcfall@redhat.com>
Diffstat (limited to 'extras/selinux')
-rw-r--r--extras/selinux/vpp-custom.te6
1 files changed, 4 insertions, 2 deletions
diff --git a/extras/selinux/vpp-custom.te b/extras/selinux/vpp-custom.te
index 2cce7471d24..4dbc2d6de2c 100644
--- a/extras/selinux/vpp-custom.te
+++ b/extras/selinux/vpp-custom.te
@@ -43,7 +43,7 @@ files_tmp_file(vpp_tmp_t)
# vpp local policy
#
-allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin }; # too benevolent
+allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin chown }; # too benevolent
dontaudit vpp_t self:capability2 block_suspend;
allow vpp_t self:process { execmem execstack setsched signal }; # too benevolent
allow vpp_t self:packet_socket { bind create setopt ioctl };
@@ -51,7 +51,8 @@ allow vpp_t self:tun_socket { create relabelto relabelfrom };
allow vpp_t self:udp_socket { create ioctl };
allow vpp_t self:unix_dgram_socket { connect create ioctl };
allow vpp_t self:unix_stream_socket { create_stream_socket_perms connectto };
-allow vpp_t self:netlink_route_socket { bind create nlmsg_write read write };
+allow vpp_t self:netlink_route_socket { bind create nlmsg_write read write getattr setopt };
+allow vpp_t self:netlink_socket { bind create setopt };
manage_dirs_pattern(vpp_t, vpp_lib_t, vpp_lib_t)
manage_files_pattern(vpp_t, vpp_lib_t, vpp_lib_t)
@@ -89,6 +90,7 @@ auth_read_passwd(vpp_t)
corenet_rw_tun_tap_dev(vpp_t)
+dev_rw_infiniband_dev(vpp_t)
dev_rw_userio_dev(vpp_t)
dev_rw_sysfs(vpp_t)
dev_read_cpuid(vpp_t)