From 80be64969d617636dcac35f9201e98160129649c Mon Sep 17 00:00:00 2001 From: Sam Hadow Date: Thu, 5 Feb 2026 11:30:36 +0100 Subject: [PATCH] policy modification openvpn --- local_vpn.te => local_openvpn.te | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) rename local_vpn.te => local_openvpn.te (68%) diff --git a/local_vpn.te b/local_openvpn.te similarity index 68% rename from local_vpn.te rename to local_openvpn.te index c015b35..04529d5 100644 --- a/local_vpn.te +++ b/local_openvpn.te @@ -10,9 +10,9 @@ require { type xdg_data_t; class file { execute_no_trans getattr open read }; class unix_stream_socket connectto; - class dir { add_name search }; + class dir { add_name search remove_name write }; class process { getcap setcap }; - class sock_file create; + class sock_file { create write getattr setattr unlink }; class lnk_file read; } @@ -20,10 +20,12 @@ require { allow NetworkManager_t lib_t:file execute_no_trans; allow NetworkManager_t openvpn_t:unix_stream_socket connectto; allow NetworkManager_t systemd_machined_t:unix_stream_socket connectto; +allow openvpn_t NetworkManager_runtime_t:dir { write remove_name }; +allow openvpn_t NetworkManager_runtime_t:sock_file { write getattr setattr unlink }; #============= openvpn_t ============== -allow openvpn_t NetworkManager_runtime_t:dir add_name; -allow openvpn_t NetworkManager_runtime_t:sock_file create; +allow openvpn_t NetworkManager_runtime_t:dir { write remove_name add_name }; +allow openvpn_t NetworkManager_runtime_t:sock_file { create write getattr setattr unlink }; allow openvpn_t lib_t:file execute_no_trans; allow openvpn_t self:process { getcap setcap }; allow openvpn_t selinux_config_t:lnk_file read;