FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
ceph-devstack/ceph_devstack/ceph_devstack.te at main · ceph/ceph-devstack · GitHub
ceph
ceph-devstack
Repository navigation
Code
Issues
4
(4)
Pull requests
8
(8)
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
ceph-devstack
/
ceph_devstack
/
ceph_devstack.te
Copy path
More file actions
More file actions
Latest commit
History
History
History
133 lines (105 loc) · 3.62 KB
Breadcrumbs
ceph-devstack
/
ceph_devstack
/
ceph_devstack.te
Copy path
File metadata and controls
133 lines (105 loc) · 3.62 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
module
ceph_devstack
1
.
0
;
require
{
type
unconfined_t;
type
container_t;
type
container_init_t;
type
proc_t;
type
sysfs_t;
type
tmpfs_t;
type
user_tmp_t;
type
devpts_t;
class
filesystem
mount;
class
filesystem
unmount;
type
null_device_t;
type
zero_device_t;
type
devtty_t;
type
random_device_t;
type
urandom_device_t;
class
chr_file mounton;
class
dir mounton;
type
proc_kcore_t;
class
file { getattr mounton open read };
type
device_t;
class
filesystem
remount;
type
sysctl_irq_t;
type
fixed_disk_device_t;
class
blk_file setattr;
class
blk_file mounton;
type
fs_t;
type
cgroup_t;
type
sysctl_t;
type
unlabeled_t;
class
chr_file getattr;
class
chr_file setattr;
class
chr_file unlink;
type
kernel_t;
class
system syslog_read;
type
iptables_t;
type
container_file_t;
class
dir ioctl;
type
init_t;
type
unconfined_service_t;
class
process siginh;
type
chkpwd_t;
type
user_devpts_t;
class
chr_file { read write };
type
proc_kmsg_t;
type
ramfs_t;
type
sysctl_kernel_t;
class
dir read;
type
system_map_t;
type
mtrr_device_t;
class
bpf prog_load;
class
bpf map_create;
type
lvm_control_t;
type
fuse_device_t;
type
tun_tap_device_t;
class
sock_file { getattr write };
class
unix_stream_socket connectto;
type
udev_var_run_t;
}
#
============= container_init_t ==============
allow
container_init_t proc_t:
filesystem
{ mount unmount remount };
allow
container_init_t sysfs_t:
filesystem
{ mount unmount remount };
allow
container_init_t tmpfs_t:
filesystem
{ mount unmount remount };
allow
container_init_t devpts_t:
filesystem
mount;
allow
container_init_t null_device_t:chr_file { mounton setattr };
allow
container_init_t zero_device_t:chr_file mounton;
allow
container_init_t devtty_t:chr_file mounton;
allow
container_init_t random_device_t:chr_file mounton;
allow
container_init_t urandom_device_t:chr_file mounton;
allow
container_init_t proc_t:dir mounton;
allow
container_init_t proc_kcore_t:file mounton;
allow
container_init_t device_t:
filesystem
{ unmount remount};
allow
container_init_t proc_t:file mounton;
allow
container_init_t sysctl_irq_t:dir mounton;
allow
container_init_t fixed_disk_device_t:blk_file setattr;
allow
container_init_t fs_t:
filesystem
remount;
allow
container_init_t cgroup_t:
filesystem
remount;
allow
container_init_t sysctl_t:dir mounton;
allow
container_init_t sysctl_t:file mounton;
allow
container_init_t unlabeled_t:chr_file { getattr unlink };
allow
container_init_t kernel_t:system syslog_read;
allow
iptables_t container_file_t:dir ioctl;
allow
init_t unconfined_service_t:process siginh;
allow
chkpwd_t user_devpts_t:chr_file { read write };
allow
container_init_t proc_kmsg_t:file mounton;
allow
container_init_t ramfs_t:
filesystem
mount;
allow
init_t chkpwd_t:process siginh;
allow
container_init_t ramfs_t:dir read;
allow
container_init_t sysctl_kernel_t:file mounton;
allow
container_init_t devpts_t:
filesystem
remount;
allow
container_init_t system_map_t:file mounton;
allow
container_init_t system_map_t:file mounton;
allow
container_init_t mtrr_device_t:file mounton;
allow
container_init_t self:bpf prog_load;
allow
container_init_t self:bpf map_create;
allow
container_init_t lvm_control_t:chr_file mounton;
allow
container_init_t fuse_device_t:chr_file mounton;
allow
container_init_t fixed_disk_device_t:blk_file mounton;
allow
container_init_t tun_tap_device_t:chr_file mounton;
allow
container_t user_tmp_t:sock_file write;
allow
container_t unconfined_t:unix_stream_socket connectto;
allow
container_init_t udev_var_run_t:dir { ioctl mounton read };
allow
container_init_t udev_var_run_t:file { getattr open read };
allow
container_init_t udev_var_run_t:sock_file getattr;
Back
|
FazBrowse Home
|
New Git URL