From 33b66b726be702dd0cdc26521381d7ba33e2bf84 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 8 Aug 2022 16:52:19 +0200 Subject: [PATCH] Allow openvswitch use its private tmpfs files and dirs Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/33b66b726be702dd0cdc26521381d7ba33e2bf84 Conflict: NA Addresses the following AVC denial: Jul 29 19:58:32.669000 localhost audit[985]: AVC avc: denied { write } for pid=985 comm="ovsdb-server" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir permissive=0 Resolves: rhbz#1988164 Signed-off-by: lujie54 --- policy/modules/contrib/openvswitch.te | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/policy/modules/contrib/openvswitch.te b/policy/modules/contrib/openvswitch.te index 9ed1587..95acc29 100644 --- a/policy/modules/contrib/openvswitch.te +++ b/policy/modules/contrib/openvswitch.te @@ -21,6 +21,9 @@ logging_log_file(openvswitch_log_t) type openvswitch_tmp_t; files_tmp_file(openvswitch_tmp_t) +type openvswitch_tmpfs_t; +files_tmpfs_file(openvswitch_tmpfs_t) + type openvswitch_var_run_t; files_pid_file(openvswitch_var_run_t) @@ -68,6 +71,9 @@ manage_lnk_files_pattern(openvswitch_t, openvswitch_tmp_t, openvswitch_tmp_t) manage_sock_files_pattern(openvswitch_t, openvswitch_tmp_t, openvswitch_tmp_t) files_tmp_filetrans(openvswitch_t, openvswitch_tmp_t, { file dir sock_file }) +manage_dirs_pattern(openvswitch_t, openvswitch_tmpfs_t, openvswitch_tmpfs_t) +fs_tmpfs_filetrans(openvswitch_t, openvswitch_tmpfs_t, dir) + manage_dirs_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) manage_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) manage_sock_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t) -- 1.8.3.1