Commit 59cc89f ("udp, udp_flow: Track our specific address on socket
interfaces") added a getsockname() call in udp_flow_new(). This requires
getattr. Fixes "Flow 0 (UDP flow): Unable to determine local address:
Permission denied" errors in muvm/passt on Fedora Linux 42 with SELinux.
The SELinux audit message is
| type=AVC msg=audit(1746083799.606:235): avc: denied { getattr } for
| pid=2961 comm="passt" laddr=127.0.0.1 lport=49221
| faddr=127.0.0.53 fport=53
| scontext=unconfined_u:unconfined_r:passt_t:s0-s0:c0.c1023
| tcontext=unconfined_u:unconfined_r:passt_t:s0-s0:c0.c1023
| tclass=udp_socket permissive=0
Fixes: 59cc89f ("udp, udp_flow: Track our specific address on socket interfaces")
Signed-off-by: Janne Grunau
---
contrib/selinux/passt.te | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
index f8ea672..eb9ce72 100644
--- a/contrib/selinux/passt.te
+++ b/contrib/selinux/passt.te
@@ -49,7 +49,7 @@ require {
type proc_net_t;
type node_t;
class tcp_socket { create accept listen name_bind name_connect getattr ioctl };
- class udp_socket { create accept listen };
+ class udp_socket { create accept listen getattr };
class icmp_socket { bind create name_bind node_bind setopt read write };
class sock_file { create unlink write };
@@ -133,7 +133,7 @@ allow passt_t node_t:icmp_socket { name_bind node_bind };
allow passt_t port_t:icmp_socket name_bind;
allow passt_t self:tcp_socket { create getopt setopt connect bind listen accept shutdown read write getattr ioctl };
-allow passt_t self:udp_socket { create getopt setopt connect bind read write };
+allow passt_t self:udp_socket { create getopt setopt connect bind read write getattr };
allow passt_t self:icmp_socket { bind create setopt read write };
allow passt_t user_tmp_t:dir { add_name write };
--
2.49.0