ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix SELinux capabilities. Creating a tap interface with 'tap connect' was returning an error when VPP was launched as a service (tested on CentOS 7.3). Adding 'net_admin' to SELinux capabilities for VPP solves the issue.

Browse Source 
Change-Id: Icd0529b49adb86e7b371283a6f39af03816951c5
Signed-off-by: Victor Nguyen <victong2@cisco.com>
This commit is contained in:
Victor Nguyen -T (victong2 - OTHERWISE PORTAGE at Cisco)
2018-02-27 18:20:03 +01:00
committed by Dave Barach
parent 8c5f67f2b8
commit 3f8562eaab
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
extras/selinux/vpp-custom.te
View File

@ -43,9 +43,9 @@ files_tmp_file(vpp_tmp_t)
# vpp local policy
#
allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin }; # too benefolent
allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin }; # too benevolent
dontaudit vpp_t self:capability2 block_suspend;
allow vpp_t self:process { execmem execstack setsched signal }; # too benefolent
allow vpp_t self:process { execmem execstack setsched signal }; # too benevolent
allow vpp_t self:packet_socket { bind create setopt ioctl };
allow vpp_t self:tun_socket { create relabelto relabelfrom };
allow vpp_t self:udp_socket { create ioctl };