From 305bd29f65b5af7b9a1c77a753ae20ccc77b26d1 Mon Sep 17 00:00:00 2001 From: Yuli Khodorkovskiy Date: Thu, 26 Jul 2018 18:37:06 -0400 Subject: [PATCH] ipsec: add missing permissions for pluto When using libreswan, pluto needs permissions for building the Security Association Database and for setting contexts on IPSec policy and SAs. Signed-off-by: Yuli Khodorkovskiy --- policy/modules/system/ipsec.te | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te index 867aefc4a..fe1132779 100644 --- a/policy/modules/system/ipsec.te +++ b/policy/modules/system/ipsec.te @@ -151,12 +151,16 @@ corenet_udp_bind_isakmp_port(ipsec_t) corenet_udp_bind_ipsecnat_port(ipsec_t) corenet_sendrecv_generic_server_packets(ipsec_t) corenet_sendrecv_isakmp_server_packets(ipsec_t) +# allow pluto to build Security Association Database +corenet_setcontext_all_spds(ipsec_t) dev_read_sysfs(ipsec_t) dev_read_rand(ipsec_t) dev_read_urand(ipsec_t) domain_use_interactive_fds(ipsec_t) +# allow pluto to set contexts on ipsec policy and SAs +domain_ipsec_setcontext_all_domains(ipsec_t) files_list_tmp(ipsec_t) files_read_etc_files(ipsec_t)