RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-03-06 08:20:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #24936 from mikechristie/igw-selinux

Browse Source 
selinux: add support for ceph iscsi

Reviewed-by: Boris Ranto <branto@redhat.com>
Reviewed-by: Jason Dillaman <dillaman@redhat.com>
This commit is contained in:
Jason Dillaman 2018-11-21 19:14:48 -05:00 committed by GitHub
commit 91bd5a3447
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 25 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
selinux/ceph.fc
View File

@ -7,10 +7,14 @@
/usr/bin/ceph-fuse -- gen_context(system_u:object_r:ceph_exec_t,s0)
/usr/bin/ceph-osd -- gen_context(system_u:object_r:ceph_exec_t,s0)
/usr/bin/radosgw -- gen_context(system_u:object_r:ceph_exec_t,s0)
/usr/bin/rbd-target-gw -- gen_context(system_u:object_r:ceph_exec_t,s0)
/usr/bin/rbd-target-api -- gen_context(system_u:object_r:ceph_exec_t,s0)
/var/lib/ceph(/.*)? gen_context(system_u:object_r:ceph_var_lib_t,s0)
/var/log/ceph(/.*)? gen_context(system_u:object_r:ceph_log_t,s0)
/var/log/radosgw(/.*)? gen_context(system_u:object_r:ceph_log_t,s0)
/var/log/rbd-target-api(/.*)? gen_context(system_u:object_r:ceph_log_t,s0)
/var/log/rbd-target-gw(/.*)? gen_context(system_u:object_r:ceph_log_t,s0)
/var/run/ceph(/.*)? gen_context(system_u:object_r:ceph_var_run_t,s0)

24
selinux/ceph.te
View File

@ -2,15 +2,21 @@ policy_module(ceph, 1.1.1)
require {
type sysfs_t;
type configfs_t;
type commplex_main_port_t;
type rpm_exec_t;
type rpm_var_lib_t;
type kernel_t;
type var_run_t;
type random_device_t;
type urandom_device_t;
type setfiles_t;
type nvme_device_t;
class sock_file unlink;
class lnk_file read;
class dir read;
class file { getattr read open };
class tcp_socket name_connect_t;
class lnk_file { create getattr read unlink };
class dir { add_name create getattr open read remove_name rmdir search write };
class file { create getattr open read rename unlink write };
class blk_file { getattr ioctl open read write };
class capability2 block_suspend;
}
@ -63,6 +69,7 @@ manage_lnk_files_pattern(ceph_t, ceph_var_run_t, ceph_var_run_t)
kernel_read_system_state(ceph_t)
kernel_read_network_state(ceph_t)
allow ceph_t kernel_t:system module_request;
corenet_all_recvfrom_unlabeled(ceph_t)
corenet_all_recvfrom_netlabel(ceph_t)
@ -75,9 +82,15 @@ corenet_sendrecv_cyphesis_server_packets(ceph_t)
corenet_tcp_bind_cyphesis_port(ceph_t)
corenet_tcp_sendrecv_cyphesis_port(ceph_t)
allow ceph_t commplex_main_port_t:tcp_socket name_connect;
corecmd_exec_bin(ceph_t)
corecmd_exec_shell(ceph_t)
allow ceph_t rpm_exec_t:file getattr;
allow ceph_t rpm_var_lib_t:dir { add_name write };
allow ceph_t rpm_var_lib_t:file { create open };
dev_read_urand(ceph_t)
domain_read_all_domains_state(ceph_t)
@ -111,6 +124,11 @@ allow ceph_t sysfs_t:dir read;
allow ceph_t sysfs_t:file { read getattr open };
allow ceph_t sysfs_t:lnk_file { read getattr };
allow ceph_t configfs_t:dir { add_name create getattr open read remove_name rmdir search write };
allow ceph_t configfs_t:file { getattr open read write };
allow ceph_t configfs_t:lnk_file { create getattr read unlink };
allow ceph_t random_device_t:chr_file getattr;
allow ceph_t urandom_device_t:chr_file getattr;
allow ceph_t self:process setpgid;