c9488cff61
In newton neutron-lbaas-agent has been renamed neutron-lbaasv2-agent. The apparmor profile and resource map requires updates to handle this. Change-Id: Ia8ac50e5e7fa32139528b90d82dfdd1489a2173a Depends-On: I69b4e3c38b7b24c4ef93010e5612faf377d7a67a
55 lines
1.2 KiB
Plaintext
55 lines
1.2 KiB
Plaintext
# Last Modified: Fri Apr 1 16:26:34 2016
|
|
# Mode: {{aa_profile_mode}}
|
|
#include <tunables/global>
|
|
|
|
/usr/bin/neutron-dhcp-agent {
|
|
#include <abstractions/base>
|
|
#include <abstractions/python>
|
|
#include <abstractions/nameservice>
|
|
|
|
/usr/bin/neutron-dhcp-agent r,
|
|
|
|
/sbin/ldconfig* rix,
|
|
|
|
/{,usr/}bin/ r,
|
|
/{,usr/}bin/** rix,
|
|
|
|
/etc/neutron/** r,
|
|
/etc/mime.types r,
|
|
/var/lib/neutron/** rwk,
|
|
/var/log/neutron/** rwk,
|
|
/{,var/}run/neutron/** rwk,
|
|
/{,var/}run/lock/neutron/** rwk,
|
|
|
|
# Allow unconfined sudo to support oslo.rootwrap
|
|
# profile makes no attempt to restrict this as this
|
|
# is limited by the appropriate rootwrap configuration.
|
|
/usr/bin/sudo Ux,
|
|
|
|
/usr/sbin/dnsmasq rix,
|
|
|
|
# Allow ip to run unrestricted for unpriviledged commands
|
|
/{,s}bin/ip Ux,
|
|
|
|
/tmp/* rw,
|
|
/var/tmp/* a,
|
|
|
|
# Required for parsing of managed process cmdline arguments
|
|
/proc/*/cmdline r,
|
|
|
|
# Required for assessment of current state of networking
|
|
/proc/sys/net/** r,
|
|
|
|
/proc/version r,
|
|
|
|
{% if ubuntu_release <= '12.04' %}
|
|
/proc/*/mounts r,
|
|
/proc/*/status r,
|
|
/proc/*/ns/net r,
|
|
{% else %}
|
|
owner @{PROC}/@{pid}/mounts r,
|
|
owner @{PROC}/@{pid}/status r,
|
|
owner @{PROC}/@{pid}/ns/net r,
|
|
{% endif %}
|
|
}
|