From: Kefu Chai <kchai@redhat.com>
Date: Tue, 19 Jul 2016 03:34:49 +0000 (+0800)
Subject: selinux: allow read /proc/<pid>/cmdline
X-Git-Tag: ses5-milestone5~358^2
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=refs%2Fpull%2F10339%2Fhead;p=ceph.git

selinux: allow read /proc/<pid>/cmdline

we read /proc/<pid>/cmdline to figure out who is terminating us.

Fixes: http://tracker.ceph.com/issues/16675
Signed-off-by: Kefu Chai <kchai@redhat.com>
---

diff --git a/selinux/ceph.te b/selinux/ceph.te
index 0e85c84bfa6..179396aaef9 100644
--- a/selinux/ceph.te
+++ b/selinux/ceph.te
@@ -75,6 +75,8 @@ corecmd_exec_shell(ceph_t)
 
 dev_read_urand(ceph_t)
 
+domain_read_all_domains_state(ceph_t)
+
 fs_getattr_all_fs(ceph_t)
 
 auth_use_nsswitch(ceph_t)