systemd: ceph-mgr: set MemoryDenyWriteExecute to false

Fixes: http://tracker.ceph.com/issues/39628
Signed-off-by: Ricardo Dias <rdias@suse.com>

diff --git a/systemd/ceph-mgr@.service.in b/systemd/ceph-mgr@.service.in
index f85047153494987f6d1c637b5f855694344025f7..c98f6378b9725169a4c6d580ae984a49e7b12f2f 100644 (file)
--- a/systemd/ceph-mgr@.service.in
+++ b/systemd/ceph-mgr@.service.in
@@ -12,7 +12,11 @@ Environment=CLUSTER=ceph
 ExecStart=/usr/bin/ceph-mgr -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
 ExecReload=/bin/kill -HUP $MAINPID
 LockPersonality=true
-MemoryDenyWriteExecute=true
+
+# We need to disable this protection as some python libraries generate
+# dynamic code, like python-cffi, and require mmap calls to succeed
+MemoryDenyWriteExecute=false
+
 NoNewPrivileges=true
 PrivateDevices=yes
 ProtectControlGroups=true