diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index 9e27a3af9..0a6b4b237 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -578,6 +578,7 @@ optional_policy(` ') optional_policy(` + lvm_admin(sysadm_t, sysadm_r) lvm_run(sysadm_t, sysadm_r) ') diff --git a/policy/modules/system/lvm.if b/policy/modules/system/lvm.if index 58bc27f22..86b223c00 100644 --- a/policy/modules/system/lvm.if +++ b/policy/modules/system/lvm.if @@ -123,3 +123,47 @@ interface(`lvm_domtrans_clvmd',` corecmd_search_bin($1) domtrans_pattern($1, clvmd_exec_t, clvmd_t) ') + +###################################### +## +## All of the rules required to +## administrate an lvm environment. +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +# +interface(`lvm_admin',` + gen_require(` + type clvmd_t, clvmd_exec_t, clvmd_initrc_exec_t; + type lvm_etc_t, lvm_lock_t, lvm_metadata_t; + type lvm_var_lib_t, lvm_var_run_t, clvmd_var_run_t, lvm_tmp_t; + ') + + allow $1 clvmd_t:process { ptrace signal_perms }; + ps_process_pattern($1, clvmd_t) + + init_startstop_service($1, $2, clvmd_t, clvmd_initrc_exec_t) + + files_search_etc($1) + admin_pattern($1, lvm_etc_t) + + files_search_locks($1) + admin_pattern($1, lvm_lock_t) + + files_search_var_lib($1) + admin_pattern($1, lvm_var_lib_t) + + files_search_pids($1) + admin_pattern($1, { lvm_var_run_t clvmd_var_run_t }) + + files_search_tmp($1) + admin_pattern($1, lvm_tmp_t) +')