[gentoo-commits] proj/hardened-refpolicy:swift commit in: policy/modules/system/

["Sven Vermeulen" <swift@gentoo.org>]

commit:     385048b24a6639c4a51573409f2b4c42692827b3
Author:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
AuthorDate: Sat Oct 10 12:08:03 2015 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Mon Oct 24 15:45:30 2016 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=385048b2

Manage tun/tap interfaces

We need the relabelfrom/relabelto rights, otherwise tun/tap interface
activities fail:

~# tunctl -d tap0
TUNSETIFF: Permission denied

 policy/modules/system/userdomain.if | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index bf78a2b..1572b51 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1300,6 +1300,9 @@ template(`userdom_admin_user_template',`
 		seutil_relabelto_bin_policy($1_t)
 		# allow to manage chr_files in user_tmp (for initrd's)
 		userdom_manage_user_tmp_chr_files($1_t)
+		# allow managing tun/tap interfaces (labeling)
+		# without this operations such as tunctl -d tap0 result in a TUNSETIFF: Device or resource busy
+		allow $1_t self:tun_socket { relabelfrom relabelto };
 	')
 ')