[ovs-dev] [PATCH] selinux: more changes to support newer hugetlbfs restrictions
Timothy Redaelli
tredaelli at redhat.com
Tue Jul 31 17:18:44 UTC 2018
The new 'map' action is needed for 'hugetlbfs_t:file' too.
CC: Aaron Conole <aconole at redhat.com>
Fixes: d2675a146130 ("selinux: changes to support newer hugetlbfs restrictions")
Signed-off-by: Timothy Redaelli <tredaelli at redhat.com>
---
selinux/openvswitch-custom.te.in | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/selinux/openvswitch-custom.te.in b/selinux/openvswitch-custom.te.in
index 21de1136d..4a16e5eef 100644
--- a/selinux/openvswitch-custom.te.in
+++ b/selinux/openvswitch-custom.te.in
@@ -90,7 +90,7 @@ allow openvswitch_t tun_tap_device_t:chr_file { read write getattr open ioctl };
@begin_dpdk@
allow openvswitch_t hugetlbfs_t:dir { write remove_name add_name lock read };
-allow openvswitch_t hugetlbfs_t:file { create unlink };
+allow openvswitch_t hugetlbfs_t:file { create unlink map };
allow openvswitch_t kernel_t:unix_stream_socket { write getattr read connectto connect setopt getopt sendto accept bind recvfrom acceptfrom };
allow openvswitch_t self:tun_socket { relabelfrom relabelto create };
allow openvswitch_t svirt_image_t:file { getattr read write };
--
2.17.1
More information about the dev
mailing list