nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Allow pacemaker to map/read/write corosync shared memory files

Browse Source 
Sep 26 18:44:56 localhost audispd: node=virtual type=AVC msg=audit(1601145893.104:2915): avc:  denied  { read write } for pid=7173 comm="stonithd" name="qb-request-cmap-header" dev="tmpfs" ino=37263 scontext=system_u:system_r:pacemaker_t:s0 tcontext=system_u:object_r:corosync_tmpfs_t:s0 tclass=file permissive=1
Sep 26 18:44:56 localhost audispd: node=virtual type=AVC msg=audit(1601145893.104:2915): avc:  denied  { open } for  pid=7173 comm="stonithd" path="/dev/shm/qb-7065-7173-28-i3gF6U/qb-request-cmap-header" dev="tmpfs" ino=37263 scontext=system_u:system_r:pacemaker_t:s0 tcontext=system_u:object_r:corosync_tmpfs_t:s0 tclass=file permissive=1
Sep 26 18:44:56 localhost audispd: node=virtual type=AVC msg=audit(1601145893.104:2916): avc:  denied  { map } for  pid=7173 comm="stonithd" path="/dev/shm/qb-7065-7173-28-i3gF6U/qb-request-cmap-header" dev="tmpfs" ino=37263 scontext=system_u:system_r:pacemaker_t:s0 tcontext=system_u:object_r:corosync_tmpfs_t:s0 tclass=file permissive=1

Signed-off-by: Dave Sugar <dsugar@tresys.com>
This commit is contained in:
Dave Sugar 2020-09-26 15:07:30 -04:00
parent f36e39b45e
commit 871348f040
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
policy/modules/services/corosync.if
View File

@ -97,6 +97,25 @@ interface(`corosync_stream_connect',`
stream_connect_pattern($1, corosync_runtime_t, corosync_runtime_t, corosync_t)
')
######################################
## <summary>
## Memmap, read and write corosync tmpfs files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`corosync_mmap_rw_tmpfs',`
gen_require(`
type corosync_tmpfs_t;
')
fs_search_tmpfs($1)
mmap_rw_files_pattern($1, corosync_tmpfs_t, corosync_tmpfs_t)
')
######################################
## <summary>
## Read and write corosync tmpfs files.

1
policy/modules/services/pacemaker.te
View File

@ -121,6 +121,7 @@ tunable_policy(`pacemaker_startstop_all_services',`
optional_policy(`
corosync_read_log(pacemaker_t)
corosync_mmap_rw_tmpfs(pacemaker_t)
corosync_stream_connect(pacemaker_t)
')