From 41deceaf25bc2360a9ee6571b5485b8a4a1cbd5b Mon Sep 17 00:00:00 2001 From: Billy McFall Date: Thu, 16 May 2019 09:13:50 -0400 Subject: VPP-1640 - Missing rules in vpp-selinux-policy SELinux exceptions occurring for host interfaces and with the vmxnet3 driver. Change-Id: Ia22bd82572acfa07ae287a755830abe1413f9939 Signed-off-by: Billy McFall --- extras/selinux/vpp-custom.te | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'extras/selinux/vpp-custom.te') diff --git a/extras/selinux/vpp-custom.te b/extras/selinux/vpp-custom.te index 4dbc2d6de2c..7cc2d55412a 100644 --- a/extras/selinux/vpp-custom.te +++ b/extras/selinux/vpp-custom.te @@ -46,7 +46,7 @@ files_tmp_file(vpp_tmp_t) allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin chown }; # too benevolent dontaudit vpp_t self:capability2 block_suspend; allow vpp_t self:process { execmem execstack setsched signal }; # too benevolent -allow vpp_t self:packet_socket { bind create setopt ioctl }; +allow vpp_t self:packet_socket { bind create setopt ioctl map }; allow vpp_t self:tun_socket { create relabelto relabelfrom }; allow vpp_t self:udp_socket { create ioctl }; allow vpp_t self:unix_dgram_socket { connect create ioctl }; @@ -96,6 +96,7 @@ dev_rw_sysfs(vpp_t) dev_read_cpuid(vpp_t) dev_rw_vfio_dev(vpp_t) dev_rw_vhost( vpp_t ) +dev_rw_generic_chr_files(vpp_t) domain_obj_id_change_exemption(vpp_t) -- cgit 1.2.3-korg