From fa5071b6d7182f54cd7b1ffe171a4b006f5255cb Mon Sep 17 00:00:00 2001 From: Boris Ranto Date: Thu, 25 Jan 2018 16:31:30 +0100 Subject: [PATCH] selinux: Allow ceph to execute ldconfig The ceph-volume testing showed that the ceph daemons can run ldconfig in a corner case when they are forbidden access to some files. This patch allows ceph to execute ldconfig in Enforcing mode. Fixes: https://tracker.ceph.com/issues/22302 Signed-off-by: Boris Ranto --- selinux/ceph.te | 1 + 1 file changed, 1 insertion(+) diff --git a/selinux/ceph.te b/selinux/ceph.te index 0a9349803b1..2dabd05c7f0 100644 --- a/selinux/ceph.te +++ b/selinux/ceph.te @@ -103,6 +103,7 @@ fstools_exec(ceph_t) nis_use_ypbind_uncond(ceph_t) storage_raw_rw_fixed_disk(ceph_t) files_manage_generic_locks(ceph_t) +libs_exec_ldconfig(ceph_t) allow ceph_t sysfs_t:dir read; allow ceph_t sysfs_t:file { read getattr open }; -- 2.39.5