Bug 1380114

Do you have selinux-policy installed?

Thanks.
Cascardo.

This request needs to be satisfied by updating the selinux targetted package, iirc.  I have one update ready to go, but we will need to run a few different devices and scenarios to make sure that we capture all of the cases.  UIO, VFIO, and vhost-user are the ones I'm thinking.  I will obtain captures and try to write up a patch for the targetted policy in the next week.

I believe the following selinux policy should cover vfio and vhost-user, but you'll need to test.  Also note that for vhost-user changes, you'll definitely need a change to the libvirt policy.  I haven't tested with uio.  Not sure how to get this into the selinux-policy or whether we should ship it as part of the ovs package (flavio / anita?)


module openvswitch-policy 1.0.1;

require {
        type openvswitch_t;
        type openvswitch_tmp_t;
        type openvswitch_var_run_t;
        type ifconfig_exec_t;
        type hostname_exec_t;
        type vfio_device_t;
        type kernel_t;
        type tun_tap_device_t;
        type hugetlbfs_t;
        type init_t;
        class netlink_socket { setopt getopt create connect getattr write read };
        class file { write getattr read open execute execute_no_trans create unlink };
        class chr_file { write getattr read open ioctl };
        class unix_stream_socket { write getattr read connectto connect setopt getopt sendto accept bind recvfrom acceptfrom };
        class dir { write remove_name add_name lock read };
}

#============= openvswitch_t ==============
allow openvswitch_t self:netlink_socket { setopt getopt create connect getattr write read };
allow openvswitch_t hostname_exec_t:file { read getattr open execute execute_no_trans };
allow openvswitch_t ifconfig_exec_t:file { read getattr open execute execute_no_trans };
allow openvswitch_t openvswitch_tmp_t:file { execute execute_no_trans };
allow openvswitch_t openvswitch_tmp_t:unix_stream_socket { write getattr read connectto connect setopt getopt sendto accept bind recvfrom acceptfrom };
allow openvswitch_t vfio_device_t:chr_file { read write open ioctl getattr };
allow openvswitch_t tun_tap_device_t:chr_file { read write getattr open ioctl };
allow openvswitch_t hugetlbfs_t:dir { write remove_name add_name lock read };
allow openvswitch_t hugetlbfs_t:file { create unlink };
allow openvswitch_t kernel_t:unix_stream_socket { write getattr read connectto connect setopt getopt sendto accept bind recvfrom acceptfrom };
allow openvswitch_t init_t:file { read open };

Hi Lukas,

The AVC denials posted on comment #5.
In additional, the selinux troubleshooter output attached for all 4 AVC denials.

Thanks,
Maxim.

Hi Lukas,

Ok. I'll try it and then post the results.

Thanks,
Maxim.

*** This bug has been marked as a duplicate of bug 1397537 ***