selinux: more changes to support newer hugetlbfs restrictions

The new 'map' action is needed for 'hugetlbfs_t:file' too. CC: Aaron Conole <[email protected]> Fixes: d2675a1 ("selinux: changes to support newer hugetlbfs restrictions") Signed-off-by: Timothy Redaelli <[email protected]> Signed-off-by: Ben Pfaff <[email protected]> Acked-by: Aaron Conole <[email protected]>
lxyustc08 · Jul 31, 2018 · 7539bfa · 7539bfa
1 parent ae6f753
commit 7539bfa
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/selinux/openvswitch-custom.te.in b/selinux/openvswitch-custom.te.in
@@ -90,7 +90,7 @@ allow openvswitch_t tun_tap_device_t:chr_file { read write getattr open ioctl };
 
 @begin_dpdk@
 allow openvswitch_t hugetlbfs_t:dir { write remove_name add_name lock read };
-allow openvswitch_t hugetlbfs_t:file { create unlink };
+allow openvswitch_t hugetlbfs_t:file { create unlink map };
 allow openvswitch_t kernel_t:unix_stream_socket { write getattr read connectto connect setopt getopt sendto accept bind recvfrom acceptfrom };
 allow openvswitch_t self:tun_socket { relabelfrom relabelto create };
 allow openvswitch_t svirt_image_t:file { getattr read write };