Re: [PATCH] selinux: Allow creating tap devices.

Aaron Conole [off-list ref] writes:

Aaron Conole [off-list ref] writes:

quoted

Daniele Di Proietto [off-list ref] writes:

quoted

On 26/01/2017 12:35, "Ansis Atteka" [off-list ref] wrote:

quoted

On 26 January 2017 at 21:24, Aaron Conole [off-list ref] wrote:
Daniele Di Proietto [off-list ref] writes:

quoted

On 25/01/2017 00:01, "Ansis Atteka" [off-list ref] wrote:

quoted

On Jan 25, 2017 4:22 AM, "Daniele Di Proietto" [off-list ref] wrote:

Current SELinux policy in RHEL and Fedora doesn't allow the creation of
TAP devices.

A tap device is used by dpif-netdev to create internal devices.

Without this patch, adding any bridge backed by the userspace datapath
would fail.

This doesn't mean that we can run Open vSwitch with DPDK under SELinux
yet, but at least we can use the userspace datapath.

Signed-off-by: Daniele Di Proietto <redacted>

I just noticed this, sorry for jumping in late.

quoted

quoted

Acked-by: Ansis Atteka <redacted>


I saw that other open source projects like OpenVPN use rw_file_perms
shortcut macro. Not sure how relevant that is for OVS but that macro
expands to a little more function calls than what you have
below. Maybe we don't need it, if what you have
just worked.

Thanks a lot for the review.

I cooked this up using audit2allow and I tested it on fedora 25.  I'm
now able to create and delete userspace bridges, without any further
complaints from selinux

I have the following openvswitch-custom.te that did work to run
ovs+dpdk under selinux and pass traffic:

I've posted a series which should allow for vfio, and vhostuser server
ports to work:

  https://mail.openvswitch.org/pipermail/ovs-dev/2017-March/330333.html

-Aaron