#1 changes to support newer hugetlbfs restrictions
Merged by aconole. Opened by tredaell.
tredaell/openvswitch-selinux-policy fix-for-hugetlbfs-restrictions  into  master

Download 1.patch

Partial backport of the following upstream commits:

commit 7539bfafac64b99ac3ffed1c40a95b9e8b38cee0
Author: Timothy Redaelli tredaelli@redhat.com
Date: Tue Jul 31 19:18:44 2018 +0200

selinux: more changes to support newer hugetlbfs restrictions
The new 'map' action is needed for 'hugetlbfs_t:file' too.
CC: Aaron Conole <aconole@redhat.com>                                       
Fixes: d2675a146130 ("selinux: changes to support newer hugetlbfs restrictions")
Signed-off-by: Timothy Redaelli <tredaelli@redhat.com>                      
Signed-off-by: Ben Pfaff <blp@ovn.org>                                      
Acked-by: Aaron Conole <aconole@redhat.com>

commit d2675a14613024b6cdcd4d4c5c3355570be124da
Author: Aaron Conole aconole@redhat.com
Date: Wed Jul 18 10:53:03 2018 -0400

selinux: changes to support newer hugetlbfs restrictions
Newer selinux base policies now split out 'map' actions, as well as         
adding more explicit checks for hugetlbfs objects.  Where previously these  
weren't required, recent changes have flagged the allocation of hugepages   
and subsequent clearing.  This means that the hugepage storage information  
for the DPDK .rte_config, and clearing actions copying from /dev/zero will  
trigger selinux denials.
This commit allows openvswitch to have more permissions for the hugetlbfs   
allocation and use.
Signed-off-by: Aaron Conole <aconole@redhat.com>                            
Acked-by: Ansis Atteka <aatteka@ovn.org>

Signed-off-by: Timothy Redaelli tredaelli@redhat.com

rebased onto 2825dac63f164fef65530bad7bf56eb5a3797cc7

Pull-Request has been merged by aconole

Metadata