Skip to content

Commit b5c3ce1

Browse files
author
Dave
authored
DOCS-15224 update selinux policy (#979)
* DOCS-15224 update selinux policy * Vertical line space * Vertical line space * Vertical line space
1 parent dc57a9f commit b5c3ce1

File tree

1 file changed

+20
-13
lines changed

1 file changed

+20
-13
lines changed

source/includes/fact-selinux-redhat-options.rst

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -67,26 +67,33 @@ to your SELinux policy:
6767
6868
#. Create a custom policy file :file:`mongodb_proc_net.te`:
6969
70-
.. code-block:: bash
70+
.. code-block:: none
7171
7272
cat > mongodb_proc_net.te <<EOF
7373
module mongodb_proc_net 1.0;
7474
7575
require {
76-
type sysctl_net_t;
77-
type mongod_t;
78-
class dir search;
79-
class file { getattr open read };
76+
type cgroup_t;
77+
type configfs_t;
78+
type file_type;
79+
type mongod_t;
80+
type proc_net_t;
81+
type sysctl_fs_t;
82+
type var_lib_nfs_t;
83+
84+
class dir { search getattr };
85+
class file { getattr open read };
8086
}
81-
82-
#============= mongod_t ==============
83-
84-
#!!!! This avc is allowed in the current policy
85-
allow mongod_t sysctl_net_t:dir search;
86-
allow mongod_t sysctl_net_t:file open;
8787
88-
#!!!! This avc is allowed in the current policy
89-
allow mongod_t sysctl_net_t:file { getattr read };
88+
#============= mongod_t ==============
89+
allow mongod_t cgroup_t:dir { search getattr } ;
90+
allow mongod_t cgroup_t:file { getattr open read };
91+
allow mongod_t configfs_t:dir getattr;
92+
allow mongod_t file_type:dir { getattr search };
93+
allow mongod_t file_type:file getattr;
94+
allow mongod_t proc_net_t:file { open read };
95+
allow mongod_t sysctl_fs_t:dir search;
96+
allow mongod_t var_lib_nfs_t:dir search;
9097
EOF
9198
9299
#. Once created, compile and load the custom policy module by

0 commit comments

Comments
 (0)