Skip to content

Commit 58c66c1

Browse files
roidayanapconole
authored andcommittedOct 9, 2024
selinux: Add missing permissions for netlink_rdma_socket.
After testing with DPDK found netlink_rdma_socket missing permissions 'getattr' and 'getopt' in the audit logs. Signed-off-by: Roi Dayan <roid@nvidia.com> Signed-off-by: Aaron Conole <aconole@redhat.com>
1 parent 4459918 commit 58c66c1

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed
 

‎selinux/openvswitch-custom.te.in

+2-2
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ require {
5252
class netlink_audit_socket { create nlmsg_relay read write };
5353
class netlink_netfilter_socket { create read write };
5454
@begin_dpdk@
55-
class netlink_rdma_socket { setopt bind create };
55+
class netlink_rdma_socket { setopt getattr getopt bind create };
5656
@end_dpdk@
5757
class netlink_socket { setopt getopt create connect getattr write read };
5858
class sock_file { write };
@@ -82,7 +82,7 @@ allow openvswitch_t self:capability { dac_override audit_write net_broadcast net
8282
allow openvswitch_t self:netlink_audit_socket { create nlmsg_relay read write };
8383
allow openvswitch_t self:netlink_netfilter_socket { create read write };
8484
@begin_dpdk@
85-
allow openvswitch_t self:netlink_rdma_socket { setopt bind create };
85+
allow openvswitch_t self:netlink_rdma_socket { setopt getattr getopt bind create };
8686
@end_dpdk@
8787
allow openvswitch_t self:netlink_socket { setopt getopt create connect getattr write read };
8888

0 commit comments

Comments
 (0)
Please sign in to comment.