23d9cac765
Within the SELinux policy file itself, the policy is referenced as `osa-neutron`, but the filename for the policy did not match. This patch fixes the filenames to match the policy name. Closes-Bug: 1742552 Change-Id: I52901ac48f9a95d0fe6b010f5940b5c39fce1aba
58 lines
2.4 KiB
Plaintext
58 lines
2.4 KiB
Plaintext
# Copyright 2017, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
module osa-neutron 1.0;
|
|
|
|
require {
|
|
type unconfined_t;
|
|
type ifconfig_t;
|
|
type neutron_var_lib_t;
|
|
type haproxy_exec_t;
|
|
type var_run_t;
|
|
type iptables_t;
|
|
type dnsmasq_t;
|
|
type var_log_t;
|
|
type http_port_t;
|
|
class process setrlimit;
|
|
class capability { dac_override net_bind_service setgid setuid };
|
|
class tcp_socket { listen name_bind };
|
|
class file { create execute execute_no_trans getattr open read relabelto setattr unlink write };
|
|
class lnk_file read;
|
|
class dir { add_name remove_name write };
|
|
}
|
|
|
|
# NOTE(mhayden): This allows dnsmasq, when run under neutron, to write logs
|
|
# within /var/log. This policy no longer exists in CentOS 7 since dnsmasq only
|
|
# writes to the systemd journal.
|
|
#============= dnsmasq_t ==============
|
|
allow dnsmasq_t var_log_t:file { open setattr };
|
|
allow dnsmasq_t var_log_t:lnk_file read;
|
|
|
|
# NOTE(mhayden): Neutron starts haproxy within a network namespace, so the
|
|
# process transitions to the ifconfig_t context after it starts. Normally,
|
|
# haproxy should switch to the ifconfig_t context. This should be fixed in
|
|
# the future.
|
|
#============= ifconfig_t ==============
|
|
allow ifconfig_t haproxy_exec_t:file { execute execute_no_trans open read };
|
|
allow ifconfig_t http_port_t:tcp_socket name_bind;
|
|
allow ifconfig_t neutron_var_lib_t:dir { add_name remove_name write };
|
|
allow ifconfig_t neutron_var_lib_t:file { create getattr open read unlink write };
|
|
allow ifconfig_t self:capability { dac_override net_bind_service setgid setuid };
|
|
allow ifconfig_t self:process setrlimit;
|
|
allow ifconfig_t self:tcp_socket listen;
|
|
|
|
# NOTE(mhayden): This allows neutron to use /usr/sbin/xtables-multi to quickly
|
|
# manage iptables/ip6tables rules.
|
|
#============= iptables_t ==============
|
|
allow iptables_t var_run_t:file read;
|