File tree Expand file tree Collapse file tree 1 file changed +20
-13
lines changed Expand file tree Collapse file tree 1 file changed +20
-13
lines changed Original file line number Diff line number Diff line change @@ -67,26 +67,33 @@ to your SELinux policy:
67
67
68
68
#. Create a custom policy file :file:` mongodb_proc_net.te` :
69
69
70
- .. code-block:: bash
70
+ .. code-block:: none
71
71
72
72
cat > mongodb_proc_net.te <<EOF
73
73
module mongodb_proc_net 1.0;
74
74
75
75
require {
76
- type sysctl_net_t;
77
- type mongod_t;
78
- class dir search;
79
- class file { getattr open read };
76
+ type cgroup_t;
77
+ type configfs_t;
78
+ type file_type;
79
+ type mongod_t;
80
+ type proc_net_t;
81
+ type sysctl_fs_t;
82
+ type var_lib_nfs_t;
83
+
84
+ class dir { search getattr };
85
+ class file { getattr open read };
80
86
}
81
-
82
- #============= mongod_t ==============
83
-
84
- #!!!! This avc is allowed in the current policy
85
- allow mongod_t sysctl_net_t:dir search;
86
- allow mongod_t sysctl_net_t:file open;
87
87
88
- #!!!! This avc is allowed in the current policy
89
- allow mongod_t sysctl_net_t:file { getattr read };
88
+ #============= mongod_t ==============
89
+ allow mongod_t cgroup_t:dir { search getattr } ;
90
+ allow mongod_t cgroup_t:file { getattr open read };
91
+ allow mongod_t configfs_t:dir getattr;
92
+ allow mongod_t file_type:dir { getattr search };
93
+ allow mongod_t file_type:file getattr;
94
+ allow mongod_t proc_net_t:file { open read };
95
+ allow mongod_t sysctl_fs_t:dir search;
96
+ allow mongod_t var_lib_nfs_t:dir search;
90
97
EOF
91
98
92
99
#. Once created, compile and load the custom policy module by
You can’t perform that action at this time.
0 commit comments