openstack
/
charm-nova-compute
Code Issues Proposed changes

Merge "add missing apparmor rules for nova-compute"

This commit is contained in:
Jenkins 2017-07-14 16:08:57 +00:00 committed by Gerrit Code Review
parent a9be067bb2 9395d9d389
commit ce7f164e7f
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
templates/usr.bin.nova-compute
View File

@ -21,6 +21,7 @@
capability setuid,
capability sys_admin,
capability sys_resource,
capability sys_module,
network inet raw,
network inet stream,
@ -30,23 +31,37 @@
/bin/* rix,
/dev/nbd* rw,
/dev/tty rw,
/dev/pts/* r,
/etc/default/locale r,
/etc/environment r,
/etc/iscsi/initiatorname.iscsi r,
/etc/machine-id r,
/etc/mtab rw,
/etc/nova/** r,
/etc/ssh/ssh_config r,
/etc/ssl/openssl.cnf r,
/etc/sudoers r,
/etc/sudoers.d/ r,
/etc/sudoers.d/* r,
/proc/*/cmdline r,
/proc/sys/net/ipv6/conf/** w,
/proc/*/task/*/comm wr,
/proc/*/fd/ r,
/proc/*/net/ip_tables_names r,
/proc/*/net/psched r,
/proc/*/stat r,
/proc/uptime r,
/proc/version r,
/run/libvirt/libvirt-sock rw,
/run/lock/nova/nova-iptables wk,
/run/lock/qemu-nbd-nbd* w,
/run/openvswitch/db.sock rw,
/sbin/brctl rix,
/sbin/ldconfig rix,
/sbin/ldconfig.real rix,
/sbin/mkfs rix,
/sbin/mkfs.fat rix,
/sbin/hdparm rix,
/sbin/xtables-multi rix,
/sys/block/ r,
/sys/devices/system/cpu/ r,
@ -54,8 +69,10 @@
/sys/devices/system/node/ r,
/sys/devices/system/node/** r,
/sys/devices/virtual/block/nbd*/ r,
/sys/devices/virtual/net/** w,
/tmp/* rw,
/tmp/*/ rw,
/tmp/** rw,
/usr/bin/ r,
/usr/bin/* rix,
/usr/lib/gcc/x86_64-linux-gnu/4.8/collect2 rix,
@ -66,8 +83,10 @@
/var/lib/lxd/unix.socket rw,
{% endif %}
/var/log/nova/nova-compute.log w,
/var/log/nova/privsep-helper.log w,
/var/run/libvirt/* rw,
/var/run/libvirt/libvirt-sock rw,
/var/run/openvswitch/db.sock rw,
/var/tmp/* w,
{% if ubuntu_release <= '12.04' %}
/proc/*/mounts r,