ipsec: improve fast path policy searching performance

[vpp.git] / extras / selinux / vpp-custom.te

diff --git a/extras/selinux/vpp-custom.te b/extras/selinux/vpp-custom.te
index e8ac50e..27abbf9 100644 (file)
--- a/extras/selinux/vpp-custom.te
+++ b/extras/selinux/vpp-custom.te
@@ -10,6 +10,8 @@ gen_require(`
     type svirt_t;
     type svirt_image_t;
     type systemd_sysctl_t;
+    type hugetlbfs_t;
+    type sysfs_t;
     class capability sys_admin;
 ')
 
@@ -43,18 +45,20 @@ files_tmp_file(vpp_tmp_t)
 # vpp local policy
 #
 
-allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin }; # too benevolent
+allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin chown }; # too benevolent
 dontaudit vpp_t self:capability2 block_suspend;
 allow vpp_t self:process { execmem execstack setsched signal }; # too benevolent
-allow vpp_t self:packet_socket { bind create setopt ioctl };
+allow vpp_t self:packet_socket { bind create setopt ioctl map read write };
 allow vpp_t self:tun_socket { create relabelto relabelfrom };
 allow vpp_t self:udp_socket { create ioctl };
 allow vpp_t self:unix_dgram_socket { connect create ioctl };
 allow vpp_t self:unix_stream_socket { create_stream_socket_perms connectto };
+allow vpp_t self:netlink_route_socket { bind create nlmsg_write read write getattr setopt };
+allow vpp_t self:netlink_socket { bind create setopt };
 
 manage_dirs_pattern(vpp_t, vpp_lib_t, vpp_lib_t)
 manage_files_pattern(vpp_t, vpp_lib_t, vpp_lib_t)
-allow vpp_t vpp_lib_t:file execute;
+allow vpp_t vpp_lib_t:file { execute map };
 files_var_lib_filetrans(vpp_t, vpp_lib_t, {file dir})
 
 manage_dirs_pattern(vpp_t, vpp_log_t, vpp_log_t)
@@ -75,6 +79,7 @@ files_tmp_filetrans(vpp_t, vpp_tmp_t, { dir sock_file file })
 
 manage_dirs_pattern(vpp_t, vpp_tmpfs_t, vpp_tmpfs_t)
 manage_files_pattern(vpp_t, vpp_tmpfs_t, vpp_tmpfs_t)
+allow vpp_t vpp_tmpfs_t:file map;
 fs_tmpfs_filetrans(vpp_t, vpp_tmpfs_t, { dir file })
 
 read_files_pattern(vpp_t, vpp_config_rw_t, vpp_config_rw_t)
@@ -88,10 +93,13 @@ auth_read_passwd(vpp_t)
 
 corenet_rw_tun_tap_dev(vpp_t)
 
+dev_rw_infiniband_dev(vpp_t)
 dev_rw_userio_dev(vpp_t)
 dev_rw_sysfs(vpp_t)
 dev_read_cpuid(vpp_t)
 dev_rw_vfio_dev(vpp_t)
+dev_rw_vhost( vpp_t )
+dev_rw_generic_chr_files(vpp_t)
 
 domain_obj_id_change_exemption(vpp_t)
 
@@ -136,4 +144,16 @@ allow vpp_t svirt_image_t:file { read write };
 
 read_files_pattern(systemd_sysctl_t, vpp_config_rw_t, vpp_config_rw_t)
 
+########################################
+#
+# hugetlbfs
+#
+
+allow vpp_t hugetlbfs_t:file map;
+
+########################################
+#
+# dpdk
+#
 
+allow vpp_t sysfs_t:file map;