From 899adbf55cf70a57db2147b2e726c53d4fd0009f Mon Sep 17 00:00:00 2001 From: Boris Ranto Date: Tue, 6 Jun 2017 21:27:54 +0200 Subject: [PATCH] selinux: Allow read on var_run_t Fixes: http://tracker.ceph.com/issues/16674 Signed-off-by: Boris Ranto --- selinux/ceph.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux/ceph.te b/selinux/ceph.te index 5c6bb8ea29ff1..272947d1e44d5 100644 --- a/selinux/ceph.te +++ b/selinux/ceph.te @@ -108,7 +108,7 @@ allow ceph_t random_device_t:chr_file getattr; allow ceph_t urandom_device_t:chr_file getattr; allow ceph_t self:process setpgid; allow ceph_t var_run_t:dir { write create add_name }; -allow ceph_t var_run_t:file { write create open getattr }; +allow ceph_t var_run_t:file { read write create open getattr }; fsadm_manage_pid(ceph_t) -- 2.39.5