From 1ac36d74210069d574e00e110dae398cae5130a6 Mon Sep 17 00:00:00 2001 From: Billy McFall Date: Wed, 14 Mar 2018 09:34:02 -0400 Subject: VPP-1197: SELinux: 'create tap' (vhost-net backend TAP) fails when SELinux is enable Update the SELinux Policy to allow management of the new vhost-net backend TAP interface. Change-Id: I2d0633a7fce2ee2a4d6e0008ab13599647c14f42 Signed-off-by: Billy McFall --- extras/selinux/vpp-custom.te | 2 ++ 1 file changed, 2 insertions(+) (limited to 'extras/selinux') diff --git a/extras/selinux/vpp-custom.te b/extras/selinux/vpp-custom.te index e8ac50e179c..2cce7471d24 100644 --- a/extras/selinux/vpp-custom.te +++ b/extras/selinux/vpp-custom.te @@ -51,6 +51,7 @@ allow vpp_t self:tun_socket { create relabelto relabelfrom }; allow vpp_t self:udp_socket { create ioctl }; allow vpp_t self:unix_dgram_socket { connect create ioctl }; allow vpp_t self:unix_stream_socket { create_stream_socket_perms connectto }; +allow vpp_t self:netlink_route_socket { bind create nlmsg_write read write }; manage_dirs_pattern(vpp_t, vpp_lib_t, vpp_lib_t) manage_files_pattern(vpp_t, vpp_lib_t, vpp_lib_t) @@ -92,6 +93,7 @@ dev_rw_userio_dev(vpp_t) dev_rw_sysfs(vpp_t) dev_read_cpuid(vpp_t) dev_rw_vfio_dev(vpp_t) +dev_rw_vhost( vpp_t ) domain_obj_id_change_exemption(vpp_t) -- cgit 1.2.3-korg