diff --git a/policy/modules/services/corosync.if b/policy/modules/services/corosync.if index f86dbed3a..ee54bc9a1 100644 --- a/policy/modules/services/corosync.if +++ b/policy/modules/services/corosync.if @@ -97,6 +97,25 @@ interface(`corosync_stream_connect',` stream_connect_pattern($1, corosync_runtime_t, corosync_runtime_t, corosync_t) ') +###################################### +## +## Memmap, read and write corosync tmpfs files. +## +## +## +## Domain allowed access. +## +## +# +interface(`corosync_mmap_rw_tmpfs',` + gen_require(` + type corosync_tmpfs_t; + ') + + fs_search_tmpfs($1) + mmap_rw_files_pattern($1, corosync_tmpfs_t, corosync_tmpfs_t) +') + ###################################### ## ## Read and write corosync tmpfs files. diff --git a/policy/modules/services/pacemaker.te b/policy/modules/services/pacemaker.te index 70d976ead..69d619a14 100644 --- a/policy/modules/services/pacemaker.te +++ b/policy/modules/services/pacemaker.te @@ -121,6 +121,7 @@ tunable_policy(`pacemaker_startstop_all_services',` optional_policy(` corosync_read_log(pacemaker_t) + corosync_mmap_rw_tmpfs(pacemaker_t) corosync_stream_connect(pacemaker_t) ')