45 lines
1.9 KiB
Diff
45 lines
1.9 KiB
Diff
From 33b66b726be702dd0cdc26521381d7ba33e2bf84 Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Mon, 8 Aug 2022 16:52:19 +0200
|
|
Subject: [PATCH] Allow openvswitch use its private tmpfs files and dirs
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/33b66b726be702dd0cdc26521381d7ba33e2bf84
|
|
Conflict: NA
|
|
|
|
Addresses the following AVC denial:
|
|
Jul 29 19:58:32.669000 localhost audit[985]: AVC avc: denied { write } for pid=985 comm="ovsdb-server" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir permissive=0
|
|
|
|
Resolves: rhbz#1988164
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/contrib/openvswitch.te | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/policy/modules/contrib/openvswitch.te b/policy/modules/contrib/openvswitch.te
|
|
index 9ed1587..95acc29 100644
|
|
--- a/policy/modules/contrib/openvswitch.te
|
|
+++ b/policy/modules/contrib/openvswitch.te
|
|
@@ -21,6 +21,9 @@ logging_log_file(openvswitch_log_t)
|
|
type openvswitch_tmp_t;
|
|
files_tmp_file(openvswitch_tmp_t)
|
|
|
|
+type openvswitch_tmpfs_t;
|
|
+files_tmpfs_file(openvswitch_tmpfs_t)
|
|
+
|
|
type openvswitch_var_run_t;
|
|
files_pid_file(openvswitch_var_run_t)
|
|
|
|
@@ -68,6 +71,9 @@ manage_lnk_files_pattern(openvswitch_t, openvswitch_tmp_t, openvswitch_tmp_t)
|
|
manage_sock_files_pattern(openvswitch_t, openvswitch_tmp_t, openvswitch_tmp_t)
|
|
files_tmp_filetrans(openvswitch_t, openvswitch_tmp_t, { file dir sock_file })
|
|
|
|
+manage_dirs_pattern(openvswitch_t, openvswitch_tmpfs_t, openvswitch_tmpfs_t)
|
|
+fs_tmpfs_filetrans(openvswitch_t, openvswitch_tmpfs_t, dir)
|
|
+
|
|
manage_dirs_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
|
|
manage_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
|
|
manage_sock_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
|
|
--
|
|
1.8.3.1
|
|
|