From: Billy McFall <bmcfall@redhat.com>
Date: Thu, 16 May 2019 13:13:50 +0000 (-0400)
Subject: VPP-1640 - Missing rules in vpp-selinux-policy
X-Git-Tag: v20.01-rc0~502
X-Git-Url: https://gerrit.fd.io/r/gitweb?a=commitdiff_plain;h=refs%2Fchanges%2F46%2F19646%2F2;p=vpp.git

VPP-1640 - Missing rules in vpp-selinux-policy
SELinux exceptions occurring for host interfaces and with the
vmxnet3 driver.

Change-Id: Ia22bd82572acfa07ae287a755830abe1413f9939
Signed-off-by: Billy McFall <bmcfall@redhat.com>
---

diff --git a/extras/selinux/vpp-custom.te b/extras/selinux/vpp-custom.te
index 4dbc2d6de2c..7cc2d55412a 100644
--- a/extras/selinux/vpp-custom.te
+++ b/extras/selinux/vpp-custom.te
@@ -46,7 +46,7 @@ files_tmp_file(vpp_tmp_t)
 allow vpp_t self:capability { dac_override ipc_lock setgid sys_rawio net_raw sys_admin net_admin chown }; # too benevolent
 dontaudit vpp_t self:capability2 block_suspend;
 allow vpp_t self:process { execmem execstack setsched signal }; # too benevolent
-allow vpp_t self:packet_socket { bind create setopt ioctl };
+allow vpp_t self:packet_socket { bind create setopt ioctl map };
 allow vpp_t self:tun_socket { create relabelto relabelfrom };
 allow vpp_t self:udp_socket { create ioctl };
 allow vpp_t self:unix_dgram_socket { connect create ioctl };
@@ -96,6 +96,7 @@ dev_rw_sysfs(vpp_t)
 dev_read_cpuid(vpp_t)
 dev_rw_vfio_dev(vpp_t)
 dev_rw_vhost( vpp_t )
+dev_rw_generic_chr_files(vpp_t)
 
 domain_obj_id_change_exemption(vpp_t)