policy_module(corosync, 1.0.0) ######################################## # # Declarations # ## ##

## Allow corosync to read and write generic tmpfs files. ##

##
gen_tunable(allow_corosync_rw_tmpfs, false) type corosync_t; type corosync_exec_t; init_daemon_domain(corosync_t, corosync_exec_t) type corosync_initrc_exec_t; init_script_file(corosync_initrc_exec_t); type corosync_tmp_t; files_tmp_file(corosync_tmp_t) type corosync_tmpfs_t; files_tmpfs_file(corosync_tmpfs_t) type corosync_var_lib_t; files_type(corosync_var_lib_t) type corosync_var_log_t; logging_log_file(corosync_var_log_t) type corosync_var_run_t; files_pid_file(corosync_var_run_t) ######################################## # # corosync local policy # allow corosync_t self:capability { dac_override sys_nice sys_ptrace sys_resource ipc_lock }; allow corosync_t self:process { setrlimit setsched signal signull }; allow corosync_t self:fifo_file rw_fifo_file_perms; allow corosync_t self:sem create_sem_perms; allow corosync_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow corosync_t self:unix_dgram_socket create_socket_perms; allow corosync_t self:udp_socket create_socket_perms; can_exec(corosync_t, corosync_exec_t) manage_dirs_pattern(corosync_t, corosync_tmp_t, corosync_tmp_t) manage_files_pattern(corosync_t, corosync_tmp_t, corosync_tmp_t) files_tmp_filetrans(corosync_t, corosync_tmp_t, { file dir }) manage_dirs_pattern(corosync_t, corosync_tmpfs_t, corosync_tmpfs_t) manage_files_pattern(corosync_t, corosync_tmpfs_t, corosync_tmpfs_t) fs_tmpfs_filetrans(corosync_t, corosync_tmpfs_t, { dir file }) manage_files_pattern(corosync_t, corosync_var_lib_t, corosync_var_lib_t) manage_dirs_pattern(corosync_t, corosync_var_lib_t, corosync_var_lib_t) manage_sock_files_pattern(corosync_t, corosync_var_lib_t, corosync_var_lib_t) files_var_lib_filetrans(corosync_t, corosync_var_lib_t, { file dir sock_file }) manage_files_pattern(corosync_t, corosync_var_log_t, corosync_var_log_t) manage_sock_files_pattern(corosync_t, corosync_var_log_t, corosync_var_log_t) logging_log_filetrans(corosync_t, corosync_var_log_t, { sock_file file }) manage_files_pattern(corosync_t, corosync_var_run_t, corosync_var_run_t) manage_sock_files_pattern(corosync_t, corosync_var_run_t, corosync_var_run_t) files_pid_filetrans(corosync_t, corosync_var_run_t, { file sock_file }) kernel_read_system_state(corosync_t) kernel_read_network_state(corosync_t) corecmd_exec_bin(corosync_t) corecmd_exec_shell(corosync_t) corenet_udp_bind_netsupport_port(corosync_t) dev_read_urand(corosync_t) domain_read_all_domains_state(corosync_t) files_manage_mounttab(corosync_t) files_read_usr_files(corosync_t) auth_use_nsswitch(corosync_t) init_read_script_state(corosync_t) init_rw_script_tmp_files(corosync_t) logging_send_syslog_msg(corosync_t) miscfiles_read_localization(corosync_t) userdom_delete_user_tmpfs_files(corosync_t) userdom_rw_user_tmpfs_files(corosync_t) tunable_policy(`allow_corosync_rw_tmpfs',` fs_rw_tmpfs_files(corosync_t) ') optional_policy(` ccs_read_config(corosync_t) ') optional_policy(` cmirrord_rw_shm(corosync_t) ') optional_policy(` lvm_rw_clvmd_tmpfs_files(corosync_t) ') optional_policy(` # to communication with RHCS rhcs_rw_cluster_shm(corosync_t) rhcs_rw_cluster_semaphores(corosync_t) rhcs_stream_connect_cluster(corosync_t) ') optional_policy(` rgmanager_manage_tmpfs_files(corosync_t) ')