From 1f4b7fa0d75d25f518047e77c88718ec1cc3f5bb Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Mon, 28 Mar 2022 11:08:39 +0200 Subject: passt, pasta: Add examples of SELinux policy modules These should cover any reasonably common use case in distributions. Signed-off-by: Stefano Brivio --- contrib/selinux/pasta.if | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 contrib/selinux/pasta.if (limited to 'contrib/selinux/pasta.if') diff --git a/contrib/selinux/pasta.if b/contrib/selinux/pasta.if new file mode 100644 index 0000000..a42bfcd --- /dev/null +++ b/contrib/selinux/pasta.if @@ -0,0 +1,25 @@ +# SPDX-License-Identifier: AGPL-3.0-or-later +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# contrib/selinux/pasta.if - SELinux profile example: Interface File for pasta +# +# Copyright (c) 2022 Red Hat GmbH +# Author: Stefano Brivio + +interface('passt_read_data',' + gen_require(` + type passt_data_t; + ') + allow $1 passt_t:dir { search add_name }; + allow $1 passt_t:file { open read getattr }; +') + +interface('pasta_read_data',' + gen_require(` + type pasta_data_t; + ') + allow $1 pasta_t:dir { search add_name }; + allow $1 pasta_t:file { open read getattr }; +') -- cgit v1.2.3