os-cinder.te

policy_module(os-cinder,0.1)

gen_require(`
        type cinder_log_t;
        type cinder_backup_t;
        type systemd_logind_t;
        type cinder_volume_t;
        type cinder_var_lib_t;
        type httpd_t;
        class file { open create append getattr lock };
        class dir { add_name write create };
        class dbus { send_msg };
        attribute cinder_domain;
')

# Bugzilla 1325623
allow httpd_t cinder_log_t:file { open create };
allow httpd_t cinder_log_t:dir { add_name write };

# Bugzilla 1820504 and 2053849
manage_dirs_pattern(httpd_t, cinder_var_lib_t, cinder_var_lib_t);

# Allow httpd to handle files in statedir
manage_files_pattern(httpd_t, cinder_var_lib_t, cinder_var_lib_t);

# Bugzilla 1384472
iscsid_domtrans(cinder_backup_t);

# Bugzilla #1628679
allow systemd_logind_t cinder_volume_t:dbus { send_msg };

# Bugzilla 1653640
gen_tunable(os_cinder_use_nfs, false)
tunable_policy(`os_cinder_use_nfs',`
        fs_manage_nfs_dirs(cinder_domain)
        fs_manage_nfs_files(cinder_domain)
        fs_manage_nfs_symlinks(cinder_domain)
        fs_exec_nfs_files(cinder_domain)
')