From mboxrd@z Thu Jan 1 00:00:00 1970 From: Aaron Conole Subject: Re: [PATCH] selinux: Allow creating tap devices. Date: Wed, 29 Mar 2017 16:03:41 -0400 Message-ID: References: <20170125022225.28883-1-diproiettod@vmware.com> <1F6C7DEC-0479-4A3F-B7BE-82BAB21D6537@vmware.com> <0CBAA34C-3F71-4C70-8B9E-59BD00E7FF68@vmware.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: "" , dev-VfR2kkLFssw@public.gmane.org To: Ansis Atteka Return-path: In-Reply-To: (Aaron Conole's message of "Thu, 09 Mar 2017 10:48:41 -0500") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: ovs-dev-bounces-yBygre7rU0TnMu66kgdUjQ@public.gmane.org Errors-To: ovs-dev-bounces-yBygre7rU0TnMu66kgdUjQ@public.gmane.org List-Id: dev.dpdk.org Aaron Conole writes: > Aaron Conole writes: >> Daniele Di Proietto writes: >>> On 26/01/2017 12:35, "Ansis Atteka" wrote: >>>>On 26 January 2017 at 21:24, Aaron Conole wrote: >>>>Daniele Di Proietto writes: >>>>> On 25/01/2017 00:01, "Ansis Atteka" wrote: >>>>>>On Jan 25, 2017 4:22 AM, "Daniele Di Proietto" wrote: >>>>>> >>>>>>Current SELinux policy in RHEL and Fedora doesn't allow the creation of >>>>>>TAP devices. >>>>>> >>>>>>A tap device is used by dpif-netdev to create internal devices. >>>>>> >>>>>>Without this patch, adding any bridge backed by the userspace datapath >>>>>>would fail. >>>>>> >>>>>>This doesn't mean that we can run Open vSwitch with DPDK under SELinux >>>>>>yet, but at least we can use the userspace datapath. >>>>>> >>>>>>Signed-off-by: Daniele Di Proietto >>>> >>>>I just noticed this, sorry for jumping in late. >>>> >>>>>>Acked-by: Ansis Atteka >>>>>> >>>>>> >>>>>>I saw that other open source projects like OpenVPN use rw_file_perms >>>>>> shortcut macro. Not sure how relevant that is for OVS but that macro >>>>>> expands to a little more function calls than what you have >>>>>> below. Maybe we don't need it, if what you have >>>>>> just worked. >>>>> >>>>> Thanks a lot for the review. >>>>> >>>>> I cooked this up using audit2allow and I tested it on fedora 25. I'm >>>>> now able to create and delete userspace bridges, without any further >>>>> complaints from selinux >>>> >>>>I have the following openvswitch-custom.te that did work to run >>>>ovs+dpdk under selinux and pass traffic: I've posted a series which should allow for vfio, and vhostuser server ports to work: https://mail.openvswitch.org/pipermail/ovs-dev/2017-March/330333.html -Aaron