Re: [PATCH] selinux: Allow creating tap devices.

[Aaron Conole <aconole-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>]

Aaron Conole <aconole-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> writes:

> Aaron Conole <aconole-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> writes:
>> Daniele Di Proietto <diproiettod-pghWNbHTmq7QT0dZR+AlfA@public.gmane.org> writes:
>>> On 26/01/2017 12:35, "Ansis Atteka" <ansisatteka-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
>>>>On 26 January 2017 at 21:24, Aaron Conole <aconole-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
>>>>Daniele Di Proietto <diproiettod-pghWNbHTmq7QT0dZR+AlfA@public.gmane.org> writes:
>>>>> On 25/01/2017 00:01, "Ansis Atteka" <ansisatteka-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
>>>>>>On Jan 25, 2017 4:22 AM, "Daniele Di Proietto" <diproiettod-pghWNbHTmq7QT0dZR+AlfA@public.gmane.org> wrote:
>>>>>>
>>>>>>Current SELinux policy in RHEL and Fedora doesn't allow the creation of
>>>>>>TAP devices.
>>>>>>
>>>>>>A tap device is used by dpif-netdev to create internal devices.
>>>>>>
>>>>>>Without this patch, adding any bridge backed by the userspace datapath
>>>>>>would fail.
>>>>>>
>>>>>>This doesn't mean that we can run Open vSwitch with DPDK under SELinux
>>>>>>yet, but at least we can use the userspace datapath.
>>>>>>
>>>>>>Signed-off-by: Daniele Di Proietto <diproiettod-pghWNbHTmq7QT0dZR+AlfA@public.gmane.org>
>>>>
>>>>I just noticed this, sorry for jumping in late.
>>>>
>>>>>>Acked-by: Ansis Atteka <aatteka-LZ6Gd1LRuIk@public.gmane.org>
>>>>>>
>>>>>>
>>>>>>I saw that other open source projects like OpenVPN use rw_file_perms
>>>>>> shortcut macro. Not sure how relevant that is for OVS but that macro
>>>>>> expands to a little more function calls than what you have
>>>>>> below. Maybe we don't need it, if what you have
>>>>>> just worked.
>>>>>
>>>>> Thanks a lot for the review.
>>>>>
>>>>> I cooked this up using audit2allow and I tested it on fedora 25.  I'm
>>>>> now able to create and delete userspace bridges, without any further
>>>>> complaints from selinux
>>>>
>>>>I have the following openvswitch-custom.te that did work to run
>>>>ovs+dpdk under selinux and pass traffic:

I've posted a series which should allow for vfio, and vhostuser server
ports to work:

  https://mail.openvswitch.org/pipermail/ovs-dev/2017-March/330333.html

-Aaron