|
 |
1ec3d1a |
policy_module(pacemaker, 1.0.0)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# Declarations
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type pacemaker_t;
|
|
|
1ec3d1a |
type pacemaker_exec_t;
|
|
|
1ec3d1a |
init_daemon_domain(pacemaker_t, pacemaker_exec_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type pacemaker_initrc_exec_t;
|
|
|
1ec3d1a |
init_script_file(pacemaker_initrc_exec_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type pacemaker_var_lib_t;
|
|
|
1ec3d1a |
files_type(pacemaker_var_lib_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
type pacemaker_var_run_t;
|
|
|
1ec3d1a |
files_pid_file(pacemaker_var_run_t)
|
|
|
1ec3d1a |
|
|
|
61fb196 |
type pacemaker_tmp_t;
|
|
|
61fb196 |
files_tmp_file(pacemaker_tmp_t)
|
|
|
61fb196 |
|
|
|
166cbdc |
type pacemaker_tmpfs_t;
|
|
|
166cbdc |
files_tmpfs_file(pacemaker_tmpfs_t)
|
|
|
166cbdc |
|
|
|
1ec3d1a |
type pacemaker_unit_file_t;
|
|
|
1ec3d1a |
systemd_unit_file(pacemaker_unit_file_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
########################################
|
|
|
1ec3d1a |
#
|
|
|
1ec3d1a |
# pacemaker local policy
|
|
|
1ec3d1a |
#
|
|
|
166cbdc |
|
|
|
166cbdc |
allow pacemaker_t self:capability { fowner fsetid kill chown dac_override setuid };
|
|
|
61fb196 |
allow pacemaker_t self:process { fork setrlimit signal setpgid };
|
|
|
1ec3d1a |
allow pacemaker_t self:fifo_file rw_fifo_file_perms;
|
|
|
166cbdc |
allow pacemaker_t self:unix_stream_socket { connectto create_stream_socket_perms };
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_dirs_pattern(pacemaker_t, pacemaker_var_lib_t, pacemaker_var_lib_t)
|
|
|
1ec3d1a |
manage_files_pattern(pacemaker_t, pacemaker_var_lib_t, pacemaker_var_lib_t)
|
|
|
1ec3d1a |
files_var_lib_filetrans(pacemaker_t, pacemaker_var_lib_t, { dir file })
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
manage_dirs_pattern(pacemaker_t, pacemaker_var_run_t, pacemaker_var_run_t)
|
|
|
1ec3d1a |
manage_files_pattern(pacemaker_t, pacemaker_var_run_t, pacemaker_var_run_t)
|
|
|
1ec3d1a |
files_pid_filetrans(pacemaker_t, pacemaker_var_run_t, { dir file })
|
|
|
1ec3d1a |
|
|
|
61fb196 |
manage_dirs_pattern(pacemaker_t, pacemaker_tmp_t, pacemaker_tmp_t)
|
|
|
61fb196 |
manage_files_pattern(pacemaker_t, pacemaker_tmp_t, pacemaker_tmp_t)
|
|
|
61fb196 |
files_tmp_filetrans(pacemaker_t, pacemaker_tmp_t, { file dir })
|
|
|
61fb196 |
|
|
|
166cbdc |
manage_dirs_pattern(pacemaker_t, pacemaker_tmpfs_t, pacemaker_tmpfs_t)
|
|
|
166cbdc |
manage_files_pattern(pacemaker_t, pacemaker_tmpfs_t, pacemaker_tmpfs_t)
|
|
|
166cbdc |
fs_tmpfs_filetrans(pacemaker_t, pacemaker_tmpfs_t, { dir file })
|
|
|
166cbdc |
|
|
|
61fb196 |
kernel_read_system_state(pacemaker_t)
|
|
|
61fb196 |
kernel_read_network_state(pacemaker_t)
|
|
|
61fb196 |
kernel_read_all_sysctls(pacemaker_t)
|
|
|
61fb196 |
kernel_read_messages(pacemaker_t)
|
|
|
61fb196 |
kernel_getattr_core_if(pacemaker_t)
|
|
|
61fb196 |
kernel_read_software_raid_state(pacemaker_t)
|
|
|
61fb196 |
|
|
|
61fb196 |
corecmd_exec_bin(pacemaker_t)
|
|
|
61fb196 |
corecmd_exec_shell(pacemaker_t)
|
|
|
61fb196 |
|
|
|
1ec3d1a |
domain_use_interactive_fds(pacemaker_t)
|
|
|
166cbdc |
domain_read_all_domains_state(pacemaker_t)
|
|
|
1ec3d1a |
|
|
|
61fb196 |
dev_getattr_mtrr_dev(pacemaker_t)
|
|
|
166cbdc |
dev_read_rand(pacemaker_t)
|
|
|
166cbdc |
dev_read_urand(pacemaker_t)
|
|
|
1ec3d1a |
|
|
|
61fb196 |
files_read_kernel_symbol_table(pacemaker_t)
|
|
|
61fb196 |
|
|
|
61fb196 |
fs_getattr_all_fs(pacemaker_t)
|
|
|
61fb196 |
|
|
|
1ec3d1a |
auth_use_nsswitch(pacemaker_t)
|
|
|
1ec3d1a |
|
|
|
1ec3d1a |
logging_send_syslog_msg(pacemaker_t)
|
|
|
1ec3d1a |
|
|
 |
46540fd |
optional_policy(`
|
|
|
166cbdc |
corosync_read_log(pacemaker_t)
|
|
|
46540fd |
corosync_stream_connect(pacemaker_t)
|
|
|
166cbdc |
corosync_rw_tmpfs(pacemaker_t)
|
|
|
46540fd |
')
|
|
|
46540fd |
|