ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

VPP-1640 - Missing rules in vpp-selinux-policy

Browse Source 
SELinux exceptions occurring for host interfaces and with the
vmxnet3 driver.

Change-Id: Ia22bd82572acfa07ae287a755830abe1413f9939
Signed-off-by: Billy McFall <bmcfall@redhat.com>
This commit is contained in:
Billy McFall
2019-05-16 09:13:50 -04:00
committed by Dave Barach
parent 5b82610cfa
commit 41deceaf25
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
extras/selinux/vpp-custom.te
View File

@ -46,7 +46,7 @@ files_tmp_file(vpp_tmp_t)
allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin chown }; # too benevolent
dontaudit vpp_t self:capability2 block_suspend;
allow vpp_t self:process { execmem execstack setsched signal }; # too benevolent
allow vpp_t self:packet_socket { bind create setopt ioctl };
allow vpp_t self:packet_socket { bind create setopt ioctl map };
allow vpp_t self:tun_socket { create relabelto relabelfrom };
allow vpp_t self:udp_socket { create ioctl };
allow vpp_t self:unix_dgram_socket { connect create ioctl };
@ -96,6 +96,7 @@ dev_rw_sysfs(vpp_t)
dev_read_cpuid(vpp_t)
dev_rw_vfio_dev(vpp_t)
dev_rw_vhost( vpp_t )
dev_rw_generic_chr_files(vpp_t)
domain_obj_id_change_exemption(vpp_t)