Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy

diff --git a/policy/modules/kernel/corenetwork.if.in b/policy/modules/kernel/corenetwork.if.in
index 096bc60b126be98d33be00621c606913b56a3a16..eb5f76e41965eb46600b1e450dcb53a651709d94 100644 (file)
--- a/policy/modules/kernel/corenetwork.if.in
+++ b/policy/modules/kernel/corenetwork.if.in
@@ -2470,6 +2470,24 @@ interface(`corenet_rw_tun_tap_dev',`
        allow $1 tun_tap_device_t:chr_file rw_chr_file_perms;
 ')
 
+########################################
+## <summary>
+##     Read and write inherited TUN/TAP virtual network device.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     The domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`corenet_rw_inherited_tun_tap_dev',`
+       gen_require(`
+               type tun_tap_device_t;
+       ')
+
+       allow $1 tun_tap_device_t:chr_file rw_inherited_chr_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     Do not audit attempts to read or write the TUN/TAP

diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 6c82b8f6c2f87d8ebd5cb192ac50a2fcc3b82c9d..dda5e2f873d695be06be739ded40e69230699928 100644 (file)
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -4602,6 +4602,24 @@ interface(`dev_rw_vhost',`
        rw_chr_files_pattern($1, device_t, vhost_device_t)
 ')
 
+########################################
+## <summary>
+##     Allow read/write inheretid the vhost net device
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`dev_rw_inherited_vhost',`
+       gen_require(`
+               type device_t, vhost_device_t;
+       ')
+
+       allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     Read and write VMWare devices.

diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
index 0caac74ee523a8c20f51590521650ed0b1ee09d9..9a965475abef6ffad0f6ae2cd49cc0516a8a6f58 100644 (file)
--- a/policy/modules/services/virt.te
+++ b/policy/modules/services/virt.te
@@ -533,9 +533,9 @@ corenet_tcp_sendrecv_generic_node(virt_domain)
 corenet_tcp_sendrecv_all_ports(virt_domain)
 corenet_tcp_bind_generic_node(virt_domain)
 corenet_tcp_bind_vnc_port(virt_domain)
-corenet_rw_tun_tap_dev(virt_domain)
 corenet_tcp_bind_virt_migration_port(virt_domain)
 corenet_tcp_connect_virt_migration_port(virt_domain)
+corenet_rw_inherited_tun_tap_dev(virt_domain)
 
 dev_read_generic_symlinks(virt_domain)
 dev_read_rand(virt_domain)
@@ -545,7 +545,7 @@ dev_write_sound(virt_domain)
 dev_rw_ksm(virt_domain)
 dev_rw_kvm(virt_domain)
 dev_rw_qemu(virt_domain)
-dev_rw_vhost(virt_domain)
+dev_rw_inherited_vhost(virt_domain)
 
 domain_use_interactive_fds(virt_domain)