passt/contrib/selinux, branch 2023_02_27.c538ee8

selinux/passt.te: Allow setting socket option on routing netlink socket

2023-02-21T18:12:37+00:00

Signed-off-by: Stefano Brivio

selinux/passt.te: Allow /etc/resolv.conf symlinks to be followed

2023-02-21T18:12:37+00:00

Signed-off-by: Stefano Brivio

selinux/passt.te: Allow setcap on the process itself

2023-02-21T18:12:37+00:00

This is needed by the new functions in isolate.c, add the
corresponding rule.

Signed-off-by: Stefano Brivio

selinux: Switch to a more reasonable model for PID and socket files

2023-02-21T18:12:37+00:00

Instead of restricting PID files to /var/run/passt.pid, which is a
single file and unlikely to be used, use the user_tmp_t type which
should cover any reasonable need.

Signed-off-by: Stefano Brivio

selinux: Define interfaces for libvirt and similar frameworks

2023-02-21T18:12:37+00:00

Services running passt will commonly need to transition to its
domain, terminate it, connect and write to its socket.

The init_daemon_domain() macro now defines the default transition to
the passt_t domain, using the passt_exec_t type.

Signed-off-by: Stefano Brivio

selinux/passt.if: Fix typo in passt_read_data interface definition

2023-02-21T18:12:30+00:00

This is an example interface, currently unused, so it went undetected:
m4 macros need a backtick at the beginning of a block instead of a
single quote.

Fixes: 1f4b7fa0d75d ("passt, pasta: Add examples of SELinux policy modules")
Signed-off-by: Stefano Brivio

passt, pasta: Add examples of SELinux policy modules

2022-03-29T13:35:38+00:00

These should cover any reasonably common use case in distributions.

Signed-off-by: Stefano Brivio