QA output created by 917
full policy modules list on the system
Checking that pcpupstream policy module has been properly installed
pcpupstream
Checking policies.
# Notes
# - lines begining # are comments for PCP QA developers and will be
#   stripped when creating 917.out from this file
# - lines beginning ! in the block below are places where the rules
#   are conditional, and the 917 script needs to mimic the configuration
#   changes that are driven from configure.ac (see the pcp_selinux_*
#   macro settings), and src/selinux/GNUlocaldefs (see the PCP_* macro 
#   settings)
# - otherwise lines in the block below come from
#   src/selinux/pcpupstream.te.in (after macro substitution)
#   
  allow [init_t] [pcp_log_t] : [dir] { read };
  allow [init_t] [pcp_log_t] : [file] { getattr };
  allow [init_t] [pcp_var_lib_t] : [dir] { add_name read write };
  allow [init_t] [pcp_var_lib_t] : [file] { append create execute execute_no_trans getattr ioctl open read write };
  allow [init_t] [pcp_var_lib_t] : [lnk_file] { read };
  allow [init_t] [tmp_t] : [file] { open };
  allow [init_t] [system_cronjob_t] : [dbus] { send_msg };
  allow [pcp_pmcd_t] [user_home_t] : [file] { execute execute_no_trans };
  allow [pcp_pmcd_t] [debugfs_t] : [file] { append getattr ioctl open read write };
! allow [pcp_pmcd_t] [pcp_pmie_exec_t] : [file] { execute execute_no_trans open read map };
  allow [pcp_pmcd_t] [pcp_var_lib_t] : [fifo_file] { getattr read open unlink };
  allow [pcp_pmcd_t] [proc_kcore_t] : [file] { getattr };
! allow [pcp_pmcd_t] [proc_security_t] : [file] { getattr open read };
  allow [pcp_pmcd_t] self : [capability] { kill sys_pacct chown sys_chroot ipc_lock sys_resource };
! allow [pcp_pmcd_t] [nsfs_t] : [file] { getattr open read };
! allow [pcp_pmcd_t] [unreserved_port_t] : [tcp_socket] { name_bind name_connect };
! allow [pcp_pmcd_t] [unreserved_port_t] : [udp_socket] { name_bind };
! allow [pcp_pmlogger_t] [unreserved_port_t] : [tcp_socket] { name_bind };
  allow [pcp_pmcd_t] [samba_var_t] : [dir] { add_name write };
  allow [pcp_pmcd_t] [samba_var_t] : [file] { create };
  allow [pcp_pmcd_t] [websm_port_t] : [tcp_socket] { name_connect };
! allow [pcp_pmcd_t] [pcp_tmp_t] : [file] { execute execute_no_trans map };
  allow [pcp_pmcd_t] [hostname_exec_t] : [file] { execute execute_no_trans getattr open read };
! allow [pcp_pmcd_t] [tracefs_t] : [filesystem] { mount };
! allow [pcp_pmcd_t] [tracefs_t] : [dir] { open read search };
! allow [pcp_pmcd_t] [tracefs_t] : [file] { append getattr open read write };
  allow [pcp_pmcd_t] [gpmctl_t] : [sock_file] { getattr };
  allow [pcp_pmcd_t] [haproxy_var_lib_t] : [sock_file] { write };
  allow [pcp_pmcd_t] [sysctl_fs_t] : [file] { write };
! allow [pcp_pmcd_t] [ldconfig_exec_t] : [file] { map };
  allow [pcp_pmcd_t] [sysfs_t] : [dir] { write };
  allow [pcp_pmcd_t] [modules_object_t] : [lnk_file] { read };
  allow [pcp_pmcd_t] [mdadm_exec_t] : [file] { execute execute_no_trans open read };
  allow [pcp_pmcd_t] [named_exec_t] : [file] { execute };
  allow [pcp_pmcd_t] [ndc_exec_t] : [file] { execute execute_no_trans };
  allow [pcp_pmcd_t] [proc_mdstat_t] : [file] { getattr open read };
! allow [pcp_pmcd_t] [numad_t] : [msgq] { unix_read };
  allow [pcp_pmcd_t] [glusterd_log_t] : [file] { open read write };
  allow [pcp_pmcd_t] self : [process] { execmem setrlimit ptrace };
  allow [pcp_pmcd_t] [sysctl_irq_t] : [dir] { search };
! allow [pcp_pmcd_t] self : [bpf] { map_create map_read map_write prog_load prog_run };
  allow [pcp_pmcd_t] [kernel_t] : [process] { signull };
! allow [pcp_pmcd_t] [unconfined_service_t] : [process] { signull };
! allow [pcp_pmcd_t] self : [capability2] { syslog };
  allow [pcp_pmcd_t] [kernel_t] : [system] { module_request };
  allow [pcp_pmcd_t] [su_exec_t] : [file] { execute execute_no_trans };
  allow [pcp_pmcd_t] [postgresql_var_run_t] : [sock_file] { write };
  allow [pcp_pmlogger_t] [kmsg_device_t] : [chr_file] { open write };
  allow [pcp_pmlogger_t] self : [capability] { kill sys_ptrace fowner fsetid };
  allow [pcp_pmlogger_t] [unconfined_t] : [process] { signal };
  allow [pcp_pmlogger_t] [unconfined_service_t] : [process] { signal };
  allow [pcp_pmlogger_t] [user_tmp_t] : [file] { setattr unlink };
  allow [pcp_pmlogger_t] [setfiles_exec_t] : [file] { execute };
! allow [pcp_pmie_t] [hostname_exec_t] : [file] { execute execute_no_trans getattr open read map };
  allow [pcp_pmie_t] self : [capability] { kill dac_override sys_ptrace net_admin chown fowner fsetid };
  allow [pcp_pmie_t] [proc_net_t] : [file] { read };
! allow [pcp_pmie_t] self : [cap_userns] { sys_ptrace };
  allow [pcp_pmie_t] self : [process] { setrlimit };
  allow [pcp_pmie_t] [unconfined_t] : [process] { signal };
  allow [pcp_pmie_t] [unconfined_service_t] : [process] { signal };
  allow [pcp_pmcd_t] [configfs_t] : [dir] { open read search write };
  allow [pcp_pmcd_t] [configfs_t] : [file] { getattr ioctl open read };
  allow [pcp_pmcd_t] [configfs_t] : [lnk_file] { read getattr };
  allow [pcp_pmcd_t] [ldconfig_exec_t] : [file] { execute execute_no_trans getattr open read };
  allow [pcp_pmcd_t] [fs_t] : [filesystem] { quotaget };
  allow [pcp_pmproxy_t] self : [capability] { dac_override net_admin };
  allow [pcp_pmproxy_t] [sysctl_net_t] : [file] { getattr open read };
  allow [pcp_pmproxy_t] [proc_net_t] : [file] { read };
! allow [pcp_pmcd_t] [fsadm_exec_t] : [file] { execute execute_no_trans getattr open read map };
  allow [pcp_pmcd_t] [fixed_disk_device_t] : [blk_file] { ioctl open read };
! allow [pcp_pmcd_t] [default_t] : [file] { execute map };
  allow [pcp_pmcd_t] self : [capability] { sys_rawio };
! allow [pcp_pmcd_t] [rpm_var_lib_t] : [file] { map };
! allow [pcp_pmcd_t] [virt_var_run_t] : [sock_file] { write };
  allow [pcp_pmcd_t] [openvswitch_exec_t] : [file] { execute execute_no_trans };
! allow [pcp_pmcd_t] [ping_exec_t] : [file] { execute execute_no_trans map };
  allow [pcp_pmcd_t] self : [capability] { net_raw };
  allow [pcp_pmcd_t] self : [process] { setcap };
! allow [pcp_pmcd_t] self : [rawip_socket] { create getopt setopt read write };
! allow [pcp_pmcd_t] self : [icmp_socket] { create getopt setopt read write };
! allow [pcp_domain] [non_auth_file_type] : [dir] { open read search getattr lock ioctl };
! allow [pcp_domain] [non_security_file_type] : [dir] { open search getattr };
! allow [pcp_domain] [non_security_file_type] : [dir] { open read search getattr lock ioctl };
  allow [pcp_pmcd_t] [file_type] : [dir] { open read search getattr lock ioctl };
  allow [pcp_pmcd_t] [file_type] : [dir] { open search getattr };
  allow [pcp_pmcd_t] [file_type] : [file] { getattr ioctl lock open read };
  allow [pcp_pmie_t] [file_type] : [dir] { open read search getattr lock ioctl };
  allow [pcp_pmie_t] [file_type] : [dir] { open search getattr };
  allow [pcp_pmie_t] [file_type] : [file] { getattr ioctl lock open read };
  allow [pcp_pmlogger_t] [file_type] : [dir] { open read search getattr lock ioctl };
  allow [pcp_pmlogger_t] [file_type] : [dir] { open search getattr };
  allow [pcp_pmlogger_t] [file_type] : [file] { getattr ioctl lock open read };
  allow [pcp_pmproxy_t] [file_type] : [dir] { open read search getattr lock ioctl };
  allow [pcp_pmproxy_t] [file_type] : [dir] { open search getattr };
  allow [pcp_pmproxy_t] [file_type] : [file] { getattr ioctl lock open read };
  allow [pcp_domain] [file_type] : [fifo_file] { getattr read open lock ioctl };
  allow [pcp_domain] [domain] : [shm] { unix_read associate getattr read };
  allow [pcp_domain] [domain] : [sem] { unix_read associate getattr read };
  allow [pcp_domain] [userdomain] : [shm] { unix_read associate getattr read };
  allow [pcp_domain] [userdomain] : [sem] { unix_read associate getattr read };
  allow [pcp_domain] [domain] : [unix_stream_socket] { connectto };
  allow [pcp_domain] [port_type] : [tcp_socket] { name_connect };
! allow [pcp_domain] [file_type] : [file] { map };
  allow [pcp_pmcd_t] [etc_t] : [dir] { open read search getattr lock ioctl };
  allow [pcp_pmcd_t] [shadow_t] : [file] { getattr ioctl lock open read };
  allow [pcp_pmie_t] [etc_t] : [dir] { open read search getattr lock ioctl };
  allow [pcp_pmie_t] [shadow_t] : [file] { getattr ioctl lock open read };
  allow [pcp_pmlogger_t] [etc_t] : [dir] { open read search getattr lock ioctl };
  allow [pcp_pmlogger_t] [shadow_t] : [file] { getattr ioctl lock open read };
  allow [pcp_pmproxy_t] [etc_t] : [dir] { open read search getattr lock ioctl };
  allow [pcp_pmproxy_t] [shadow_t] : [file] { getattr ioctl lock open read };

