openstack/charm-nova-compute
Code Issues Proposed changes

add missing apparmor rules for nova-compute

Browse Source 
In a restrictive mode those will prevent nodes from starting up.

Change-Id: I589d1e1d082f5c66adf641b4d748bffb25eb40b7
This commit is contained in:
Dmitrii Shcherbakov 2017-07-04 15:40:43 +02:00
parent 2088bdda1e
commit 9395d9d389
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
templates/usr.bin.nova-compute
View File

@ -21,6 +21,7 @@
capability setuid, capability setuid,
capability sys_admin, capability sys_admin,
capability sys_resource, capability sys_resource,
capability sys_module,
network inet raw, network inet raw,
network inet stream, network inet stream,
@ -30,23 +31,37 @@
/bin/* rix, /bin/* rix,
/dev/nbd* rw, /dev/nbd* rw,
/dev/tty rw, /dev/tty rw,
/dev/pts/* r,
/etc/default/locale r, /etc/default/locale r,
/etc/environment r, /etc/environment r,
/etc/iscsi/initiatorname.iscsi r,
/etc/machine-id r, /etc/machine-id r,
/etc/mtab rw, /etc/mtab rw,
/etc/nova/** r, /etc/nova/** r,
/etc/ssh/ssh_config r,
/etc/ssl/openssl.cnf r,
/etc/sudoers r, /etc/sudoers r,
/etc/sudoers.d/ r, /etc/sudoers.d/ r,
/etc/sudoers.d/* r, /etc/sudoers.d/* r,
/proc/*/cmdline r,
/proc/sys/net/ipv6/conf/** w,
/proc/*/task/*/comm wr,
/proc/*/fd/ r, /proc/*/fd/ r,
/proc/*/net/ip_tables_names r, /proc/*/net/ip_tables_names r,
/proc/*/net/psched r, /proc/*/net/psched r,
/proc/*/stat r, /proc/*/stat r,
/proc/uptime r,
/proc/version r,
/run/libvirt/libvirt-sock rw, /run/libvirt/libvirt-sock rw,
/run/lock/nova/nova-iptables wk, /run/lock/nova/nova-iptables wk,
/run/lock/qemu-nbd-nbd* w, /run/lock/qemu-nbd-nbd* w,
/run/openvswitch/db.sock rw,
/sbin/brctl rix,
/sbin/ldconfig rix, /sbin/ldconfig rix,
/sbin/ldconfig.real rix, /sbin/ldconfig.real rix,
/sbin/mkfs rix,
/sbin/mkfs.fat rix,
/sbin/hdparm rix,
/sbin/xtables-multi rix, /sbin/xtables-multi rix,
/sys/block/ r, /sys/block/ r,
/sys/devices/system/cpu/ r, /sys/devices/system/cpu/ r,
@ -54,8 +69,10 @@
/sys/devices/system/node/ r, /sys/devices/system/node/ r,
/sys/devices/system/node/** r, /sys/devices/system/node/** r,
/sys/devices/virtual/block/nbd*/ r, /sys/devices/virtual/block/nbd*/ r,
/sys/devices/virtual/net/** w,
/tmp/* rw, /tmp/* rw,
/tmp/*/ rw, /tmp/*/ rw,
/tmp/** rw,
/usr/bin/ r, /usr/bin/ r,
/usr/bin/* rix, /usr/bin/* rix,
/usr/lib/gcc/x86_64-linux-gnu/4.8/collect2 rix, /usr/lib/gcc/x86_64-linux-gnu/4.8/collect2 rix,
@ -66,8 +83,10 @@
/var/lib/lxd/unix.socket rw, /var/lib/lxd/unix.socket rw,
{% endif %} {% endif %}
/var/log/nova/nova-compute.log w, /var/log/nova/nova-compute.log w,
/var/log/nova/privsep-helper.log w,
/var/run/libvirt/* rw, /var/run/libvirt/* rw,
/var/run/libvirt/libvirt-sock rw, /var/run/libvirt/libvirt-sock rw,
/var/run/openvswitch/db.sock rw,
/var/tmp/* w, /var/tmp/* w,
{% if ubuntu_release <= '12.04' %} {% if ubuntu_release <= '12.04' %}
/proc/*/mounts r, /proc/*/mounts r,