06b3a4837f
allow some selinux rules to allow swift-rings to be retreived from the host. Closes-Bug: #1646124 Change-Id: I64955a4616b08bba6a4efd22c5e35180388db4a2
37 lines
1.1 KiB
Plaintext
37 lines
1.1 KiB
Plaintext
# Copyright 2017, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
module osa_swift 1.0;
|
|
|
|
require {
|
|
type sshd_t;
|
|
type swift_data_t;
|
|
type syslogd_t;
|
|
type default_t;
|
|
type postfix_local_t;
|
|
class file { getattr open read };
|
|
class dir { search write };
|
|
}
|
|
|
|
#============= postfix_local_t ==============
|
|
allow postfix_local_t swift_data_t:dir search;
|
|
|
|
#============= sshd_t ==============
|
|
allow sshd_t swift_data_t:file { getattr open read };
|
|
|
|
#============= syslogd_t ==============
|
|
|
|
#!!!! WARNING: 'default_t' is a base type.
|
|
allow syslogd_t default_t:dir write;
|
|
|