From 1c99acbb4e920e169a7eea1f8b55bbdfcf9725ca Mon Sep 17 00:00:00 2001 From: Brad Hubbard Date: Wed, 8 Apr 2020 14:49:04 +1000 Subject: [PATCH] selinux: Allow getattr access to /proc/kcore Required for an fstat call in BlkDev::get_devid Fixes: https://tracker.ceph.com/issues/40743 Signed-off-by: Brad Hubbard --- selinux/ceph.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/selinux/ceph.te b/selinux/ceph.te index 15f3e1c12e0fc..bcdafec7f1eac 100644 --- a/selinux/ceph.te +++ b/selinux/ceph.te @@ -13,6 +13,7 @@ require { type setfiles_t; type nvme_device_t; type httpd_config_t; + type proc_kcore_t; class sock_file unlink; class tcp_socket name_connect_t; class lnk_file { create getattr read unlink }; @@ -151,6 +152,8 @@ allow init_t ceph_t:process2 { nnp_transition nosuid_transition }; allow ceph_t httpd_config_t:dir search; +allow ceph_t proc_kcore_t:file getattr; + fsadm_manage_pid(ceph_t) #============= setfiles_t ============== -- 2.39.5