From 2bd78f27bb7a806bf89070c31e4f813b61f1155e Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Mon, 14 Feb 2022 10:51:06 +0100
Subject: [PATCH] Allow systemd-networkd create and use netlink netfilter
 socket

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/2bd78f27bb7a806bf89070c31e4f813b61f1155e
Conflict: NA

Resolves: rhbz#2054006
Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/system/systemd.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 2d8db7e..476e2d3 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -490,6 +490,7 @@ allow systemd_networkd_t self:process { getcap setcap };
 
 allow systemd_networkd_t self:netlink_kobject_uevent_socket create_socket_perms;
 allow systemd_networkd_t self:netlink_generic_socket create_socket_perms;
+allow systemd_networkd_t self:netlink_netfilter_socket create_socket_perms;
 allow systemd_networkd_t self:netlink_route_socket { create_socket_perms nlmsg_read nlmsg_write };
 allow systemd_networkd_t self:unix_dgram_socket create_socket_perms;
 allow systemd_networkd_t self:packet_socket create_socket_perms;
-- 
1.8.3.1