X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=extras%2Fselinux%2Fvpp-custom.te;h=7cc2d55412a7d4dd699ec9c04ebbd869a02ca27a;hb=c025329bb244952938c8575a1d5602a1e54e5fe7;hp=2cce7471d2437d8fa035d3e24ada91381d4746ab;hpb=1ac36d74210069d574e00e110dae398cae5130a6;p=vpp.git

diff --git a/extras/selinux/vpp-custom.te b/extras/selinux/vpp-custom.te
index 2cce7471d24..7cc2d55412a 100644
--- a/extras/selinux/vpp-custom.te
+++ b/extras/selinux/vpp-custom.te
@@ -43,15 +43,16 @@ files_tmp_file(vpp_tmp_t)
 # vpp local policy
 #
 
-allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin }; # too benevolent
+allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin chown }; # too benevolent
 dontaudit vpp_t self:capability2 block_suspend;
 allow vpp_t self:process { execmem execstack setsched signal }; # too benevolent
-allow vpp_t self:packet_socket { bind create setopt ioctl };
+allow vpp_t self:packet_socket { bind create setopt ioctl map };
 allow vpp_t self:tun_socket { create relabelto relabelfrom };
 allow vpp_t self:udp_socket { create ioctl };
 allow vpp_t self:unix_dgram_socket { connect create ioctl };
 allow vpp_t self:unix_stream_socket { create_stream_socket_perms connectto };
-allow vpp_t self:netlink_route_socket { bind create nlmsg_write read write };
+allow vpp_t self:netlink_route_socket { bind create nlmsg_write read write getattr setopt };
+allow vpp_t self:netlink_socket { bind create setopt };
 
 manage_dirs_pattern(vpp_t, vpp_lib_t, vpp_lib_t)
 manage_files_pattern(vpp_t, vpp_lib_t, vpp_lib_t)
@@ -89,11 +90,13 @@ auth_read_passwd(vpp_t)
 
 corenet_rw_tun_tap_dev(vpp_t)
 
+dev_rw_infiniband_dev(vpp_t)
 dev_rw_userio_dev(vpp_t)
 dev_rw_sysfs(vpp_t)
 dev_read_cpuid(vpp_t)
 dev_rw_vfio_dev(vpp_t)
 dev_rw_vhost( vpp_t )
+dev_rw_generic_chr_files(vpp_t)
 
 domain_obj_id_change_exemption(vpp_t)