module ceph_devstack 1.0; require { type container_init_t; type proc_t; type sysfs_t; type tmpfs_t; type devpts_t; class filesystem mount; class filesystem unmount; type null_device_t; type zero_device_t; type devtty_t; type random_device_t; type urandom_device_t; class chr_file mounton; class dir mounton; type proc_kcore_t; class file mounton; type device_t; class filesystem remount; type sysctl_irq_t; type fixed_disk_device_t; class blk_file setattr; class blk_file mounton; type fs_t; type cgroup_t; type sysctl_t; type unlabeled_t; class chr_file getattr; class chr_file setattr; class chr_file unlink; type kernel_t; class system syslog_read; type iptables_t; type container_file_t; class dir ioctl; type init_t; type unconfined_service_t; class process siginh; type chkpwd_t; type user_devpts_t; class chr_file { read write }; type proc_kmsg_t; type ramfs_t; type sysctl_kernel_t; class dir read; type system_map_t; type mtrr_device_t; class bpf prog_load; class bpf map_create; type lvm_control_t; type fuse_device_t; type tun_tap_device_t; } #============= container_init_t ============== allow container_init_t proc_t:filesystem { mount unmount remount }; allow container_init_t sysfs_t:filesystem { mount unmount remount }; allow container_init_t tmpfs_t:filesystem { mount unmount remount }; allow container_init_t devpts_t:filesystem mount; allow container_init_t null_device_t:chr_file { mounton setattr }; allow container_init_t zero_device_t:chr_file mounton; allow container_init_t devtty_t:chr_file mounton; allow container_init_t random_device_t:chr_file mounton; allow container_init_t urandom_device_t:chr_file mounton; allow container_init_t proc_t:dir mounton; allow container_init_t proc_kcore_t:file mounton; allow container_init_t device_t:filesystem { unmount remount}; allow container_init_t proc_t:file mounton; allow container_init_t sysctl_irq_t:dir mounton; allow container_init_t fixed_disk_device_t:blk_file setattr; allow container_init_t fs_t:filesystem remount; allow container_init_t cgroup_t:filesystem remount; allow container_init_t sysctl_t:dir mounton; allow container_init_t sysctl_t:file mounton; allow container_init_t unlabeled_t:chr_file { getattr unlink }; allow container_init_t kernel_t:system syslog_read; allow iptables_t container_file_t:dir ioctl; allow init_t unconfined_service_t:process siginh; allow chkpwd_t user_devpts_t:chr_file { read write }; allow container_init_t proc_kmsg_t:file mounton; allow container_init_t ramfs_t:filesystem mount; allow init_t chkpwd_t:process siginh; allow container_init_t ramfs_t:dir read; allow container_init_t sysctl_kernel_t:file mounton; allow container_init_t devpts_t:filesystem remount; allow container_init_t system_map_t:file mounton; allow container_init_t system_map_t:file mounton; allow container_init_t mtrr_device_t:file mounton; allow container_init_t self:bpf prog_load; allow container_init_t self:bpf map_create; allow container_init_t lvm_control_t:chr_file mounton; allow container_init_t fuse_device_t:chr_file mounton; allow container_init_t fixed_disk_device_t:blk_file mounton; allow container_init_t tun_tap_device_t:chr_file mounton;