1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
## <summary>Ceph distributed object storage</summary>
#########################################
## <summary>
## Create the individual Ceph domains
## </summary>
## <param name="cephdaemon">
## <summary>
## The daemon (osd, mds or mon) for which the rules are created
## </summary>
## </param>
#
template(`ceph_domain_template',`
gen_require(`
attribute cephdomain;
attribute cephdata;
attribute cephpidfile;
attribute_role ceph_roles;
type ceph_runtime_t;
')
type ceph_$1_t, cephdomain;
type ceph_$1_exec_t;
init_system_domain(ceph_$1_t, ceph_$1_exec_t)
role ceph_roles types ceph_$1_t;
type ceph_$1_data_t, cephdata;
files_type(ceph_$1_data_t)
type ceph_$1_runtime_t, cephpidfile;
typealias ceph_$1_runtime_t alias ceph_$1_var_run_t;
files_runtime_file(ceph_$1_runtime_t)
########################################
#
# Local policy
#
# Rules which cannot be made part of the domain
allow ceph_$1_t ceph_$1_runtime_t:file manage_file_perms;
allow ceph_$1_t ceph_$1_runtime_t:sock_file manage_sock_file_perms;
allow ceph_$1_t ceph_$1_data_t:dir manage_dir_perms;
allow ceph_$1_t ceph_$1_data_t:file manage_file_perms;
filetrans_pattern(ceph_$1_t, ceph_runtime_t, ceph_$1_runtime_t, { file sock_file })
files_var_lib_filetrans(ceph_$1_t, ceph_$1_data_t, { file dir })
')
#########################################
## <summary>
## Administrative access for Ceph
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access
## </summary>
## </param>
## <param name="role">
## <summary>
## Domain allowed access
## </summary>
## </param>
#
interface(`ceph_admin',`
gen_require(`
attribute cephdomain, cephdata;
type ceph_initrc_exec_t, ceph_log_t;
type ceph_conf_t, ceph_key_t;
')
allow $1 cephdomain:process { ptrace signal_perms };
ps_process_pattern($1, cephdomain)
init_startstop_service($1, $2, cephdomain, ceph_initrc_exec_t)
allow $1 ceph_initrc_exec_t:lnk_file read_lnk_file_perms;
allow $1 ceph_initrc_exec_t:file read_file_perms;
files_list_etc($1)
admin_pattern($1, ceph_conf_t)
admin_pattern($1, ceph_key_t)
admin_pattern($1, cephdata)
admin_pattern($1, ceph_log_t)
')
#########################################
## <summary>
## Read Ceph key files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access
## </summary>
## </param>
#
interface(`ceph_read_key',`
gen_require(`
type ceph_key_t;
')
allow $1 ceph_key_t:file read_file_perms;
')
|
GitWeb