From 060718414c20c06375b40a7fb4fdfb1254c7ccc4 Mon Sep 17 00:00:00 2001 From: Brad Hubbard Date: Tue, 7 Apr 2020 09:35:06 +1000 Subject: [PATCH] selinux: Allow ceph-mgr access to httpd dir ceph-mgr loads modules which require read access and this causes a denial on el7. Fixes: https://tracker.ceph.com/issues/44216 Signed-off-by: Brad Hubbard (cherry picked from commit 35a7fc8249337c3c59f0c561632abf578f5d20fc) --- selinux/ceph.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/selinux/ceph.te b/selinux/ceph.te index 06db59c911a1f..d805a6c9909e5 100644 --- a/selinux/ceph.te +++ b/selinux/ceph.te @@ -7,6 +7,7 @@ require { type urandom_device_t; type setfiles_t; type nvme_device_t; + type httpd_config_t; class sock_file unlink; class lnk_file read; class dir read; @@ -119,6 +120,8 @@ allow ceph_t self:process setpgid; allow ceph_t var_run_t:dir { write create add_name }; allow ceph_t var_run_t:file { read write create open getattr }; +allow ceph_t httpd_config_t:dir search; + fsadm_manage_pid(ceph_t) #============= setfiles_t ============== -- 2.39.5