From 2825dac63f164fef65530bad7bf56eb5a3797cc7 Mon Sep 17 00:00:00 2001 From: Timothy Redaelli Date: Aug 01 2018 11:05:15 +0000 Subject: changes to support newer hugetlbfs restrictions Partial backport of the following upstream commits: commit 7539bfafac64b99ac3ffed1c40a95b9e8b38cee0 Author: Timothy Redaelli Date: Tue Jul 31 19:18:44 2018 +0200 selinux: more changes to support newer hugetlbfs restrictions The new 'map' action is needed for 'hugetlbfs_t:file' too. CC: Aaron Conole Fixes: d2675a146130 ("selinux: changes to support newer hugetlbfs restrictions") Signed-off-by: Timothy Redaelli Signed-off-by: Ben Pfaff Acked-by: Aaron Conole commit d2675a14613024b6cdcd4d4c5c3355570be124da Author: Aaron Conole Date: Wed Jul 18 10:53:03 2018 -0400 selinux: changes to support newer hugetlbfs restrictions Newer selinux base policies now split out 'map' actions, as well as adding more explicit checks for hugetlbfs objects. Where previously these weren't required, recent changes have flagged the allocation of hugepages and subsequent clearing. This means that the hugepage storage information for the DPDK .rte_config, and clearing actions copying from /dev/zero will trigger selinux denials. This commit allows openvswitch to have more permissions for the hugetlbfs allocation and use. Signed-off-by: Aaron Conole Acked-by: Ansis Atteka Signed-off-by: Timothy Redaelli --- diff --git a/openvswitch-custom.te b/openvswitch-custom.te index 6f04118..21fa07f 100644 --- a/openvswitch-custom.te +++ b/openvswitch-custom.te @@ -16,11 +16,12 @@ require { type svirt_image_t; type svirt_tmpfs_t; type vfio_device_t; + type zero_device_t; class capability { dac_override audit_write net_raw net_broadcast }; - class chr_file { write getattr read open ioctl }; - class dir { write remove_name add_name lock read }; - class file { write getattr read open execute execute_no_trans create unlink }; + class chr_file { write getattr read open ioctl map }; + class dir { write remove_name add_name lock read getattr search open }; + class file { write getattr read open execute execute_no_trans create unlink map }; class netlink_audit_socket { create nlmsg_relay audit_write read write }; class netlink_socket { setopt getopt create connect getattr write read }; class packet_socket create_socket_perms; @@ -43,10 +44,12 @@ allow openvswitch_t openvswitch_rw_t:dir { write remove_name add_name lock read allow openvswitch_t openvswitch_rw_t:file { write getattr read open execute execute_no_trans create unlink }; allow openvswitch_t openvswitch_tmp_t:file { execute execute_no_trans }; allow openvswitch_t openvswitch_tmp_t:unix_stream_socket { write getattr read connectto connect setopt getopt sendto accept bind recvfrom acceptfrom }; +allow openvswitch_t openvswitch_var_run_t:dir { getattr read open search write remove_name add_name lock }; +allow openvswitch_t openvswitch_var_run_t:file { map open read write getattr create unlink }; allow openvswitch_t tun_tap_device_t:chr_file { read write getattr open ioctl }; allow openvswitch_t hugetlbfs_t:dir { write remove_name add_name lock read }; -allow openvswitch_t hugetlbfs_t:file { create unlink }; +allow openvswitch_t hugetlbfs_t:file { create unlink map }; allow openvswitch_t kernel_t:unix_stream_socket { write getattr read connectto connect setopt getopt sendto accept bind recvfrom acceptfrom }; allow openvswitch_t self:tun_socket { relabelfrom relabelto create }; allow openvswitch_t svirt_image_t:file { getattr read write }; @@ -54,3 +57,4 @@ allow openvswitch_t svirt_tmpfs_t:file { read write }; allow openvswitch_t svirt_tmpfs_t:sock_file { read write append getattr open }; allow openvswitch_t svirt_t:unix_stream_socket { connectto read write getattr sendto recvfrom setopt }; allow openvswitch_t vfio_device_t:chr_file { read write open ioctl getattr }; +allow openvswitch_t zero_device_t:chr_file { read open getattr map };