[ovs-dev] [PATCH] selinux: update for netlink socket types

Aaron Conole aconole at redhat.com
Thu Apr 18 21:00:25 UTC 2019


Ansis Atteka <ansisatteka at gmail.com> writes:

> On Wed, 17 Apr 2019 at 13:07, Aaron Conole <aconole at redhat.com> wrote:
>>
>> These are used for interfacing with conntrack, as well as by some
>> DPDK PMDs
>
> Did you get these with audit2allow? If so, then looks good to me.

Yes.  Sorry, I should have put the AVCs and the resulting permissions
stuff in the commit message.  I'll do that next time.

>> Signed-off-by: Aaron Conole <aconole at redhat.com>
>> ---
>>  selinux/openvswitch-custom.te.in | 8 ++++++++
>>  1 file changed, 8 insertions(+)
>>
>> diff --git a/selinux/openvswitch-custom.te.in b/selinux/openvswitch-custom.te.in
>> index 26495828a..2adaf231f 100644
>> --- a/selinux/openvswitch-custom.te.in
>> +++ b/selinux/openvswitch-custom.te.in
>> @@ -49,6 +49,10 @@ require {
>>          class filesystem getattr;
>>          class lnk_file { read open };
>>          class netlink_audit_socket { create nlmsg_relay audit_write read write };
>> +        class netlink_netfilter_socket { create nlmsg_relay audit_write read write };
>> + at begin_dpdk@
>> +        class netlink_rdma_socket { setopt bind create };
>> + at end_dpdk@
>>          class netlink_socket { setopt getopt create connect getattr write read };
>>          class sock_file { write };
>>          class system { module_load module_request };
>> @@ -75,6 +79,10 @@ domtrans_pattern(openvswitch_t, openvswitch_load_module_exec_t, openvswitch_load
>>  #============= openvswitch_t ==============
>>  allow openvswitch_t self:capability { dac_override audit_write net_broadcast net_raw };
>>  allow openvswitch_t self:netlink_audit_socket { create nlmsg_relay audit_write read write };
>> +allow openvswitch_t self:netlink_netfilter_socket { create nlmsg_relay audit_write read write };
>> + at begin_dpdk@
>> +allow openvswitch_t self:netlink_rdma_socket { setopt bind create };
>> + at end_dpdk@
>>  allow openvswitch_t self:netlink_socket { setopt getopt create connect getattr write read };
>>
>>  allow openvswitch_t hostname_exec_t:file { read getattr open execute execute_no_trans };
>> --
>> 2.19.1
>>


More information about the dev mailing list