gian/ceph-mirror
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2026-08-02 07:03:18 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

selinux: Allow nvme devices

Browse Source 
This commit allows nvme devices which use a different label than
standard block devices.

Fixes: http://tracker.ceph.com/issues/19200
Signed-off-by: Boris Ranto <branto@redhat.com>
This commit is contained in:
Boris Ranto 2017-06-09 14:38:28 +02:00
parent 0a8ceaa3a5
commit a8af61c8da
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
selinux/ceph.te
View File

@ -5,11 +5,13 @@ require {
type var_run_t;
type random_device_t;
type urandom_device_t;
type setfiles_t;
type setfiles_t;
type nvme_device_t;
class sock_file unlink;
class lnk_file read;
class dir read;
class file { getattr read open };
class blk_file { getattr ioctl open read write };
}
########################################
@ -86,6 +88,8 @@ logging_send_syslog_msg(ceph_t)
sysnet_dns_name_resolve(ceph_t)
allow ceph_t nvme_device_t:blk_file { getattr ioctl open read write };
# basis for future security review
allow ceph_t ceph_var_run_t:sock_file { create unlink write setattr };
allow ceph_t self:capability { sys_rawio chown };