Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow container_file_t for libvirt daemons #111

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Allow container_file_t for libvirt daemons #111

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions os-nova.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ gen_require(`
type iptables_t;
type modules_conf_t;
type container_share_t;
type container_file_t;
type container_runtime_t;
attribute nova_domain;
class key write;
Expand Down Expand Up @@ -122,6 +123,7 @@ optional_policy(`
type systemd_machined_t;
type container_runtime_t;
type container_share_t;
type container_file_t;
type container_unit_file_t;
type svirt_sandbox_file_t;
type spc_t;
Expand All @@ -139,6 +141,7 @@ optional_policy(`

container_read_share_files(svirt_t)
allow svirt_t container_share_t:file { entrypoint execute };
allow svirt_t container_file_t:file { entrypoint execute };

allow svirt_t spc_t:dir search;
allow svirt_t spc_t:fifo_file write_file_perms;
Expand All @@ -150,6 +153,9 @@ allow svirt_tcg_t container_runtime_t:process sigchld;
allow svirt_tcg_t container_share_t:file { execute getattr read entrypoint open };
allow svirt_tcg_t container_share_t:lnk_file read;
allow svirt_tcg_t container_share_t:dir read;
allow svirt_tcg_t container_file_t:file { execute getattr read entrypoint open };
allow svirt_tcg_t container_file_t:lnk_file read;
allow svirt_tcg_t container_file_t:dir read;

# Bug 1640528
auth_use_pam(nova_t)
Expand Down