From 33b66b726be702dd0cdc26521381d7ba33e2bf84 Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Mon, 8 Aug 2022 16:52:19 +0200
Subject: [PATCH] Allow openvswitch use its private tmpfs files and dirs

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/33b66b726be702dd0cdc26521381d7ba33e2bf84
Conflict: NA

Addresses the following AVC denial:
Jul 29 19:58:32.669000 localhost audit[985]: AVC avc:  denied  { write } for  pid=985 comm="ovsdb-server" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir permissive=0

Resolves: rhbz#1988164
Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/contrib/openvswitch.te | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/policy/modules/contrib/openvswitch.te b/policy/modules/contrib/openvswitch.te
index 9ed1587..95acc29 100644
--- a/policy/modules/contrib/openvswitch.te
+++ b/policy/modules/contrib/openvswitch.te
@@ -21,6 +21,9 @@ logging_log_file(openvswitch_log_t)
 type openvswitch_tmp_t;
 files_tmp_file(openvswitch_tmp_t)
 
+type openvswitch_tmpfs_t;
+files_tmpfs_file(openvswitch_tmpfs_t)
+
 type openvswitch_var_run_t;
 files_pid_file(openvswitch_var_run_t)
 
@@ -68,6 +71,9 @@ manage_lnk_files_pattern(openvswitch_t, openvswitch_tmp_t, openvswitch_tmp_t)
 manage_sock_files_pattern(openvswitch_t, openvswitch_tmp_t, openvswitch_tmp_t)
 files_tmp_filetrans(openvswitch_t, openvswitch_tmp_t, { file dir sock_file })
 
+manage_dirs_pattern(openvswitch_t, openvswitch_tmpfs_t, openvswitch_tmpfs_t)
+fs_tmpfs_filetrans(openvswitch_t, openvswitch_tmpfs_t, dir)
+
 manage_dirs_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
 manage_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
 manage_sock_files_pattern(openvswitch_t, openvswitch_var_run_t, openvswitch_var_run_t)
-- 
1.8.3.1