type svirt_t;
type svirt_image_t;
type systemd_sysctl_t;
+ type hugetlbfs_t;
+ type sysfs_t;
class capability sys_admin;
')
allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin chown }; # too benevolent
dontaudit vpp_t self:capability2 block_suspend;
allow vpp_t self:process { execmem execstack setsched signal }; # too benevolent
-allow vpp_t self:packet_socket { bind create setopt ioctl map };
+allow vpp_t self:packet_socket { bind create setopt ioctl map read write };
allow vpp_t self:tun_socket { create relabelto relabelfrom };
allow vpp_t self:udp_socket { create ioctl };
allow vpp_t self:unix_dgram_socket { connect create ioctl };
manage_dirs_pattern(vpp_t, vpp_lib_t, vpp_lib_t)
manage_files_pattern(vpp_t, vpp_lib_t, vpp_lib_t)
-allow vpp_t vpp_lib_t:file execute;
+allow vpp_t vpp_lib_t:file { execute map };
files_var_lib_filetrans(vpp_t, vpp_lib_t, {file dir})
manage_dirs_pattern(vpp_t, vpp_log_t, vpp_log_t)
manage_dirs_pattern(vpp_t, vpp_tmpfs_t, vpp_tmpfs_t)
manage_files_pattern(vpp_t, vpp_tmpfs_t, vpp_tmpfs_t)
+allow vpp_t vpp_tmpfs_t:file map;
fs_tmpfs_filetrans(vpp_t, vpp_tmpfs_t, { dir file })
read_files_pattern(vpp_t, vpp_config_rw_t, vpp_config_rw_t)
read_files_pattern(systemd_sysctl_t, vpp_config_rw_t, vpp_config_rw_t)
+########################################
+#
+# hugetlbfs
+#
+
+allow vpp_t hugetlbfs_t:file map;
+
+########################################
+#
+# dpdk
+#
+allow vpp_t sysfs_t:file map;