mir/openvswitch
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-10-27 15:18:06 +00:00
Code Issues Releases Wiki Activity
Files
6d97adeea9c7e88fe8d41049453bb212e5fbcd9f
openvswitch/selinux/automake.mk

22 lines
683 B
Makefile
Raw Normal View History

rhel: provide our own SELinux custom policy package CentOS, RHEL and Fedora distributions ship with their own Open vSwitch SELinux policy that is too strict and prevents Open vSwitch to work normally out of the box. As a solution, this patch introduces a new package which will "loosen" up "openvswitch_t" SELinux domain so that Open vSwitch could operate normally. Intended use-cases of this package are: 1. to allow users to install newer Open vSwitch on already released Fedora, RHEL and CentOS distributions where the default Open vSwitch SELinux policy that shipped with the corresponding Linux distribution is not up to date and did not anticipate that a newer Open vSwitch version might need to invoke new system calls or need to access certain system resources that it did not before; And 2. to provide alternative means through which Open vSwitch developers can proactively fix SELinux related policy issues without waiting for corresponding Linux distribution maintainers to update their central Open vSwitch SELinux policy. This patch was tested on Fedora 23 and CentOS 7. I verified that now on Fedora 23 Open vSwitch can create a NetLink socket; and that I did not see following error messages: vlog|INFO|opened log file /var/log/openvswitch/ovs-vswitchd.log ovs_numa|INFO|Discovered 2 CPU cores on NUMA node 0 ovs_numa|INFO|Discovered 1 NUMA nodes and 2 CPU cores reconnect|INFO|unix:/var/run/openvswitch/db.sock: connecting... reconnect|INFO|unix:/var/run/openvswitch/db.sock: connected netlink_socket|ERR|fcntl: Permission denied dpif_netlink|ERR|Generic Netlink family 'ovs_datapath' does not exist. The Open vSwitch kernel module is p robably not loaded. dpif|WARN|failed to enumerate system datapaths: Permission denied dpif|WARN|failed to create datapath ovs-system: Permission denied I did not test all Open vSwitch features so there still could be some OVS configuration that would get "Permission denied" errors. Since, Open vSwitch daemons on Ubuntu 15.10 by default run under "unconfined" SELinux domain, then there is no need to create a similar debian package for Ubuntu, because it works on default Ubuntu installation. Signed-off-by: Ansis Atteka <aatteka@nicira.com> Acked-by: Flavio Leitner <fbl@sysclose.com>
2016-01-19 09:59:12 -08:00
# Copyright (C) 2016 Nicira, Inc.
#
# Copying and distribution of this file, with or without modification,
# are permitted in any medium without royalty provided the copyright
# notice and this notice are preserved. This file is offered as-is,
# without warranty of any kind.
EXTRA_DIST += \
selinux: introduce domain transitioned kmod helper This commit uses the previously defined selinux label to transition from the openvswitch_t to openvswitch_load_module_t domain by executing ovs-kmod-ctl that is labelled with openvswitch_load_module_exec_t type. Note that unless the selinux relabel operation is invoked, the script will not be labelled. This merely instructs the selinux tools that ovs-kmod-ctl should have a label applied. Acked-by: Ansis Atteka <aatteka@ovn.org> Acked-by: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Aaron Conole <aconole@redhat.com>
2018-06-01 14:28:48 -04:00
selinux/openvswitch-custom.fc.in \
rhel: make the selinux policy intermediate This will be used by an upcoming commit to have @begin_ and @end_ dpdk blocks to keep dpdk specific policy decisions only active when dpdk is used. Acked-by: Flavio Leitner <fbl@sysclose.org> Acked-by: Ansis Atteka <aatteka@ovn.org> Signed-off-by: Aaron Conole <aconole@redhat.com> Tested-by: Jean Hsiao <jhsiao@redhat.com>
2017-08-31 19:22:43 -04:00
selinux/openvswitch-custom.te.in
selinux: add a new target to build the policy The selinux policy currently builds manually, as a process that either the user or distribution maintainer undertakes. That process consists of: 1. Convert the intermediary files into their file form through 'make' statements at the top level. 2. Change to the selinux directory and issue the selinux "make -f" directive. This commit introduces a new target 'selinux-policy' which builds the openvswitch-custom policy files. Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Ansis Atteka <aatteka@ovn.org>
2018-02-19 10:14:22 -05:00
PHONY: selinux-policy
selinux: introduce domain transitioned kmod helper This commit uses the previously defined selinux label to transition from the openvswitch_t to openvswitch_load_module_t domain by executing ovs-kmod-ctl that is labelled with openvswitch_load_module_exec_t type. Note that unless the selinux relabel operation is invoked, the script will not be labelled. This merely instructs the selinux tools that ovs-kmod-ctl should have a label applied. Acked-by: Ansis Atteka <aatteka@ovn.org> Acked-by: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Aaron Conole <aconole@redhat.com>
2018-06-01 14:28:48 -04:00
selinux-policy: selinux/openvswitch-custom.te selinux/openvswitch-custom.fc
selinux: add a new target to build the policy The selinux policy currently builds manually, as a process that either the user or distribution maintainer undertakes. That process consists of: 1. Convert the intermediary files into their file form through 'make' statements at the top level. 2. Change to the selinux directory and issue the selinux "make -f" directive. This commit introduces a new target 'selinux-policy' which builds the openvswitch-custom policy files. Signed-off-by: Aaron Conole <aconole@redhat.com> Acked-by: Ansis Atteka <aatteka@ovn.org>
2018-02-19 10:14:22 -05:00
$(MAKE) -C selinux/ -f /usr/share/selinux/devel/Makefile
selinux: drop autogenerated files When running a make clean, it is desirable for the autogenerated files to be removed. Signed-off-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ben Pfaff <blp@ovn.org>
2018-02-27 10:11:37 -05:00
CLEANFILES += \
selinux/openvswitch-custom.te \
selinux/openvswitch-custom.pp \
selinux/openvswitch-custom.fc \
selinux/openvswitch-custom.if
Reference in New Issue Copy Permalink