From b22d93a40cc5eec8a1880667d3335816901d33ce Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Fri, 3 Jan 2025 11:31:02 +0100 Subject: [PATCH] Update virtqemud policy regarding the svirt_tcg_t domain --- policy/modules/contrib/virt.te | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/policy/modules/contrib/virt.te b/policy/modules/contrib/virt.te index a1a08ca823..d41ed65624 100644 --- a/policy/modules/contrib/virt.te +++ b/policy/modules/contrib/virt.te @@ -2109,7 +2109,6 @@ allow virtqemud_t self:bpf { map_create map_read map_write prog_load prog_run }; allow virtqemud_t self:capability { audit_write chown dac_override dac_read_search fowner fsetid kill net_admin setpcap setgid setuid sys_admin sys_chroot sys_ptrace sys_rawio sys_resource }; allow virtqemud_t self:capability2 { bpf perfmon }; allow virtqemud_t self:cap_userns kill; - allow virtqemud_t self:netlink_audit_socket { nlmsg_relay read write }; allow virtqemud_t self:process { getpgid setcap setexec setrlimit setsched setsockcreate }; allow virtqemud_t self:tcp_socket create_socket_perms; @@ -2124,8 +2123,8 @@ allow virtqemud_t svirt_t:tcp_socket create_stream_socket_perms; allow virtqemud_t svirt_t:udp_socket create_socket_perms; allow virtqemud_t svirt_t:unix_stream_socket { connectto create_stream_socket_perms }; allow virtqemud_t svirt_socket_t:unix_stream_socket connectto; -allow virtqemud_t svirt_tcg_t: process { setsched signal signull transition }; -allow virtqemud_t svirt_tcg_t: unix_stream_socket { connectto create_stream_socket_perms }; +allow virtqemud_t svirt_tcg_t:process { getrlimit getsched setsched signal signull transition }; +allow virtqemud_t svirt_tcg_t:unix_stream_socket { connectto create_stream_socket_perms }; allow virtqemud_t svirt_devpts_t:chr_file open; allow virtqemud_t svirt_tmpfs_t:file { map write }; @@ -2182,6 +2181,7 @@ manage_sock_files_pattern(virtqemud_t, svirt_image_t, svirt_image_t) read_files_pattern(virtqemud_t, svirt_t, svirt_t) read_lnk_files_pattern(virtqemud_t, svirt_t, svirt_t) read_files_pattern(virtqemud_t, svirt_tcg_t, svirt_tcg_t) +read_lnk_files_pattern(virtqemud_t, svirt_tcg_t, svirt_tcg_t) manage_files_pattern(virtqemud_t, virt_content_t, virt_content_t)