charm-neutron-gateway/templates/usr.bin.neutron-openvswitch...

65 lines
1.4 KiB
Plaintext

# Last Modified: Fri Apr 1 16:26:34 2016
# Mode: {{aa_profile_mode}}
#include <tunables/global>
/usr/bin/neutron-openvswitch-agent {
#include <abstractions/base>
#include <abstractions/python>
#include <abstractions/nameservice>
#include <abstractions/bash>
/usr/bin/neutron-openvswitch-agent r,
/sbin/ldconfig* rix,
/{,usr/}bin/ r,
/{,usr/}bin/** rix,
/etc/neutron/** r,
/etc/magic r,
/etc/mime.types r,
/etc/udev/udev.conf r,
/var/lib/neutron/** rwk,
/var/log/neutron/** rwk,
/{,var/}run/neutron/** rwk,
/{,var/}run/lock/neutron/** rwk,
/run/udev/* r,
/run/uuidd/request rw,
/sys/kernel/uevent_seqnum r,
/usr/share/file/magic.mgc r,
/usr/share/file/magic/ r,
# Allow unconfined sudo to support oslo.rootwrap
# profile makes no attempt to restrict this as this
# is limited by the appropriate rootwrap configuration.
/usr/bin/sudo Ux,
# Allow ip and ps to run unrestricted for unpriviledged commands
/{,s}bin/ip Ux,
/{,s}bin/ps Ux,
/tmp/* rw,
/tmp/** rw,
/var/tmp/* a,
# Required for parsing of managed process cmdline arguments
/proc/*/cmdline r,
# Required for assessment of current state of networking
/proc/sys/net/** r,
/proc/version r,
{% if ubuntu_release <= '12.04' %}
/proc/*/mounts r,
/proc/*/status r,
/proc/*/stat r,
/proc/*/ns/net r,
{% else %}
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/status r,
owner @{PROC}/@{pid}/ns/net r,
{% endif %}
}