From: Brad Hubbard Date: Wed, 19 Feb 2020 03:36:24 +0000 (+1000) Subject: selinux: Allow ceph to setsched X-Git-Tag: v14.2.10~150^2 X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=d6ef174aedd8795c67038cb116985d4e3e4ff655;p=ceph.git selinux: Allow ceph to setsched In several places, such as common/numa.cc we call sched_setaffinity which requires this permission. Fixes: https://tracker.ceph.com/issues/44196 Signed-off-by: Brad Hubbard (cherry picked from commit 43103e0207bfacf02f7f9533b36443d65f95d718) --- diff --git a/selinux/ceph.te b/selinux/ceph.te index c3be384c56ba..e2a848149ccb 100644 --- a/selinux/ceph.te +++ b/selinux/ceph.te @@ -142,6 +142,7 @@ allow ceph_t configfs_t:lnk_file { create getattr read unlink }; allow ceph_t random_device_t:chr_file getattr; allow ceph_t urandom_device_t:chr_file getattr; allow ceph_t self:process setpgid; +allow ceph_t self:process setsched; allow ceph_t var_run_t:dir { write create add_name }; allow ceph_t var_run_t:file { read write create open getattr }; allow ceph_t init_var_run_t:file getattr;