Aaron Conole <acon...@redhat.com> writes: > Aaron Conole <acon...@redhat.com> writes: >> Daniele Di Proietto <diproiet...@vmware.com> writes: >>> On 26/01/2017 12:35, "Ansis Atteka" <ansisatt...@gmail.com> wrote: >>>>On 26 January 2017 at 21:24, Aaron Conole <acon...@redhat.com> wrote: >>>>Daniele Di Proietto <diproiet...@vmware.com> writes: >>>>> On 25/01/2017 00:01, "Ansis Atteka" <ansisatt...@gmail.com> wrote: >>>>>>On Jan 25, 2017 4:22 AM, "Daniele Di Proietto" <diproiet...@vmware.com> >>>>>>wrote: >>>>>> >>>>>>Current SELinux policy in RHEL and Fedora doesn't allow the creation of >>>>>>TAP devices. >>>>>> >>>>>>A tap device is used by dpif-netdev to create internal devices. >>>>>> >>>>>>Without this patch, adding any bridge backed by the userspace datapath >>>>>>would fail. >>>>>> >>>>>>This doesn't mean that we can run Open vSwitch with DPDK under SELinux >>>>>>yet, but at least we can use the userspace datapath. >>>>>> >>>>>>Signed-off-by: Daniele Di Proietto <diproiet...@vmware.com> >>>> >>>>I just noticed this, sorry for jumping in late. >>>> >>>>>>Acked-by: Ansis Atteka <aatt...@ovn.org> >>>>>> >>>>>> >>>>>>I saw that other open source projects like OpenVPN use rw_file_perms >>>>>> shortcut macro. Not sure how relevant that is for OVS but that macro >>>>>> expands to a little more function calls than what you have >>>>>> below. Maybe we don't need it, if what you have >>>>>> just worked. >>>>> >>>>> Thanks a lot for the review. >>>>> >>>>> I cooked this up using audit2allow and I tested it on fedora 25. I'm >>>>> now able to create and delete userspace bridges, without any further >>>>> complaints from selinux >>>> >>>>I have the following openvswitch-custom.te that did work to run >>>>ovs+dpdk under selinux and pass traffic:
I've posted a series which should allow for vfio, and vhostuser server ports to work: https://mail.openvswitch.org/pipermail/ovs-dev/2017-March/330333.html -Aaron _______________________________________________ dev mailing list d...@openvswitch.org https://mail.openvswitch.org/mailman/listinfo/ovs-dev