From 7539bfafac64b99ac3ffed1c40a95b9e8b38cee0 Mon Sep 17 00:00:00 2001 From: Timothy Redaelli Date: Tue, 31 Jul 2018 19:18:44 +0200 Subject: selinux: more changes to support newer hugetlbfs restrictions The new 'map' action is needed for 'hugetlbfs_t:file' too. CC: Aaron Conole Fixes: d2675a146130 ("selinux: changes to support newer hugetlbfs restrictions") Signed-off-by: Timothy Redaelli Signed-off-by: Ben Pfaff Acked-by: Aaron Conole --- selinux/openvswitch-custom.te.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'selinux/openvswitch-custom.te.in') diff --git a/selinux/openvswitch-custom.te.in b/selinux/openvswitch-custom.te.in index 21de1136d..4a16e5eef 100644 --- a/selinux/openvswitch-custom.te.in +++ b/selinux/openvswitch-custom.te.in @@ -90,7 +90,7 @@ allow openvswitch_t tun_tap_device_t:chr_file { read write getattr open ioctl }; @begin_dpdk@ allow openvswitch_t hugetlbfs_t:dir { write remove_name add_name lock read }; -allow openvswitch_t hugetlbfs_t:file { create unlink }; +allow openvswitch_t hugetlbfs_t:file { create unlink map }; allow openvswitch_t kernel_t:unix_stream_socket { write getattr read connectto connect setopt getopt sendto accept bind recvfrom acceptfrom }; allow openvswitch_t self:tun_socket { relabelfrom relabelto create }; allow openvswitch_t svirt_image_t:file { getattr read write }; -- cgit v1.2.1