From 8fd5128aa31ed80f266708f8c737c28ae001dbc5 Mon Sep 17 00:00:00 2001 From: Cédric Jeanneret Date: Jan 28 2019 14:36:57 +0000 Subject: Allow openvswitch to manage its files/sockets in a container context If we're to use and manage openvswitch from within containers, we must enable a couple of new policies so that it can actually manage its socket and directories, especially if they are bind-mounts --- diff --git a/openvswitch-custom.te b/openvswitch-custom.te index 655c717..9cc3f75 100644 --- a/openvswitch-custom.te +++ b/openvswitch-custom.te @@ -65,3 +65,6 @@ allow openvswitch_t zero_device_t:chr_file { read open getattr map }; allow openvswitch_t container_var_run_t:dir write; openvswitch_stream_connect(container_t); + +manage_files_pattern(openvswitch_t, container_file_t, container_file_t) +manage_sock_files_pattern(openvswitch_t, container_file_t, container_file_t)