From 3f8562eaab8a6a495debd8480f6ea31c6173d5d9 Mon Sep 17 00:00:00 2001 From: "Victor Nguyen -T (victong2 - OTHERWISE PORTAGE at Cisco)" Date: Tue, 27 Feb 2018 18:20:03 +0100 Subject: Fix SELinux capabilities. Creating a tap interface with 'tap connect' was returning an error when VPP was launched as a service (tested on CentOS 7.3). Adding 'net_admin' to SELinux capabilities for VPP solves the issue. Change-Id: Icd0529b49adb86e7b371283a6f39af03816951c5 Signed-off-by: Victor Nguyen --- extras/selinux/vpp-custom.te | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'extras/selinux') diff --git a/extras/selinux/vpp-custom.te b/extras/selinux/vpp-custom.te index e0a1f64d018..e8ac50e179c 100644 --- a/extras/selinux/vpp-custom.te +++ b/extras/selinux/vpp-custom.te @@ -43,9 +43,9 @@ files_tmp_file(vpp_tmp_t) # vpp local policy # -allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin }; # too benefolent +allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin }; # too benevolent dontaudit vpp_t self:capability2 block_suspend; -allow vpp_t self:process { execmem execstack setsched signal }; # too benefolent +allow vpp_t self:process { execmem execstack setsched signal }; # too benevolent allow vpp_t self:packet_socket { bind create setopt ioctl }; allow vpp_t self:tun_socket { create relabelto relabelfrom }; allow vpp_t self:udp_socket { create ioctl }; -- cgit 1.2.3-korg